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Web Service User Productivity Loss 
Cost Estimate 


Average # Qtr. Hr. Lost Hr. Lost 
Requests/hr Per user Per user 
5532 $29,499.39 | $117,997.56 

| $44,872.99 |$179,491.95 
$179,491.95 | $717,967.80 


Web Service 
DefenseLINK 
www.dtic.mil 
Down 1 Hour 
Down 4 Hours 


Productivity Loss Range: $44,872.99 to $717,967.80 


Notes and Assumptions: 
Average downtime of server is 1 hour. 
The server could be brought down multiple times during an event, driving up user impact costs. 
Some Users will perform other productive tasks after failing to access server and if possible, revert to manual systems. 
Some Users will face a greater impact than others, therefor a cost estimate range is being provided. 
$21.33 / hour average base salary (excluding overhead). Average grade 9.3. 
Taken from Profile of Federal Civilian Non-Postal Employees March 31, 1998 
DefenseLINK and www.dtic.mil are on the same hardware. 
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Down 4 Hours 


Productivity Loss Range: $44,872.99 to $717,967.80 


Notes and Assumptions: 
Average downtime of server is 1 hour. 
The server could be brought down multiple times during an event, driving up user impact costs. 
Some Users will perform other productive tasks after failing to access server and if possible, revert to manual systems. 
Some Users will face a greater impact than others, therefor a cost estimate range is being provided. 
$21.33 / hour average base salary (excluding overhead). Average grade 9.3. 
Taken from Profile of Federal Civilian Non-Postal Employees March 31, 1998 
DefenseLINK and www.dtic.mil are on the same hardware. 
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To give you some idea of the impact of a hacker or a denial of service attack bringing 
down our public access servers we are providing statistics from our log files and a 
narrative summary for some of our more popular web services. 


The Statistics consist of the service title, the number of unique IP addresses to visit the 
site in a week and the average number of pages per hour and day. 


Example: 
PER DIEM 
23152 unique hosts. 
823.9 html pages per hour. 


19773 html pages each day.(Average estimate) 


These statistics can be used as an indicator as to how many users would be effected if the 
service was brought down by a denial of service attack. The listing provided here are for 
the week before the attack and the week after the attack. They are further split by 
DefenseLINK sub level sites and other sites residing on the same hardware server. 


The narratives will provide some sense of the impact this service has on the user 
community. Once again it is divided by DefenseLINK and other sites residing on the 
same hardware server. 


I hope you will find this material helpful in understanding why we work very hard to 
preserve access and integrity to the server. 


b6é 


For Official Use Only 


Denial of Service Attack against DefenseLINK. 


DTIC became aware in late August that DefenseLINK was the target of a cyberattack. 
Sponsored by the ELECTRONIC DISTURBANCE THEATER. See news release below. 


They planned to flood DefenseLINK and other selected web sites with requests for 
service in an attempt to cause the system to choke and thus deny access to other users. 
The group provided its members with a software program, a java applet, which accessed 
the target site(s) every few seconds. 


In preparation for the attack DTIC took precautionary steps to minimize the effect of such 
an attack, but warned customers that access to DefenseLINK might be diminished. 
TIC’s primary point of contact in OSD PA notified OSD of the expected attack on 
Friday, September 4. The following is his email message. b6 
b7C per DTIC 
An activist group is apparently planning an "Electronic Civil Disobedience" 
attack on Sep 9, and several other dates later in the fall. They plan to 
flood DefenseLINK and other selected web sites with requests for service in 
an attempt to cause the system to choke and thus deny access to other users.” 
The group provides its members with a software program which accesses the 
target site(s) every few seconds. 


DTIC has taken a range of steps to minimize the effect of such an attack, 
but access to DefenseLINK may be slow or be delayed on Sep 9. 


There is a backup DefenseLINK web site at the DTIC offices in San Diego, CA. 
The URL to access the backup DefenseLINK site is: 

http://alt.defenselink.mil This alternative site is updated every few hours 

so will not have new releases as soon as they are posted. 


The group's news release is below. 


: b6 
[ ] b7C per DTIC 


ELECTRONIC DISTURBANCE THEATER BULLETIN 

Advance News Release. 

Tuesday, August 25, 1998 

TELL THE WORLD: STOP THE WAR IN MEXICO NETSTRIKE AGAINST 
GOVERNMENT, MILITARY, AND FINANCIAL WEB SITES IN MEXICO, 
THE UNITED STATES, AND GERMANY CALL FOR FLOODNET ACTIONS 
(SWARM) ON SEPTEMBER 9 AGAINST PRESIDENT ZEDILLO, 
PENTAGON, AND FRANKFURT STOCK EXCHANGE FALL CAMPAIGN 
ON THE STREET AND THE NET REAL AND VIRTUAL TOGETHER 

In solidarity with the Zapatistas, indigenous peoples in Chiapas, others 
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resisting the Mexican government, the global pro-Zapatista movement, and people 
everywhere struggling against neoliberalism and the global economy, the 
Electronic Disturbance Theater urges SWARM actions, multiple acts of 
Electronic Civil Disobedience, on Wednesday, September 9, 1998. 
(http://www.nyu.edu/projects/wray/ecd.html) 

To demonstrate our capacity for simultaneous global electronic actions and 

to emphasize the multiple nature of our opponents, FloodNet will target 

three web sites in Mexico, the United States, and Europe representing three 
important sectors: government, military, and financial. In Mexico, FloodNet will 
target President Zedillo's web site, (http://www.presidencia.gob.mx/) an obvious 
choice and one we have made before. In the United States, FloodNet will 

target the Pentagon, (http://(www.defenselink.mil/) also an 
obvious choice given the level of U.S. military and intelligence involvement 

in Mexico. And in Germany, FloodNet will target the Frankfurt Stock 
Exchange, (http://www.exchange.de/) a less obvious choice, but one that makes 
sense as it is a key European financial site with 

high symbolic value and as Germany is a major player in the global neoliberal 
economy. The Electronic Disturbance Theater calls these electronic actions in 
conjunction with its participation in the Ars Electronica Festival on 

Infowar, held in Linz, Austria, from September 7 to 12. 
(http://web.aec.at/infowar/) We urge people to join our actions and we urge 
people to engage in their own actions at the same time as ours. We urge multiple 
actions, virtual and real, on multiple levels, aimed at multiple targets, from 
multiple sources, both on September 9, but also for a series of dates scheduled for 
this fall. We call for hybrid street/Net actions on September 16, October 12, and 
November 22. September 16 is Mexican Independence Day. 

The Mexico Solidarity Network in North America has called for a month-long 
series of activities starting on this day and ending on October 12, Columbus Day 
in the United States. The North East Zapatista Solidarity Network has 

called for actions on October 12. And in New York, on Oct. 12, the New York 
Zapatistas are planning a Festival of Resistance that includes a march to the 
United Nations. As happened last year, this November 22 there will be another 
civil disobedience action at the School of the Americas, a good opportunity for a 
joint civil disobedience - electronic civil disobedience action. Stay tuned to th 
Electronic Civil Disobedience page for details of Sept. 9, Sept. 16, Oct. 12, Nov. 
22, and other actions this fall. http://www.nyu.edu/projects/wray/ecd.html (site 
just reorganized - take a look) * The Electronic Disturbance Theater 


On the day of the attack, repeated accesses to the DTIC servers begin shortly after 
midnight. The approach being taken was to tie up our search engine with multiple 
requests, increasing server load and thereby slowing response times. Initially many of the 
requests were coming from a specific network in Austria. Access from this network to 
DTIC computer systems was blocked at the at the DTIC router. 
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DTIC programmers noticed consistencies in the large URL's used by the attacking 
requests and, using a simple Perl CGI program, filtered out the unwanted requests by 
sending them a "Location" command that redirected their requests to the URL of a 
non-existent web server. After the filter was in place, load on the server dropped 
significantly. 


The Reuters News Pentagon Beats Back Internet Attack, Thursday, September 10, 
1998 indicated that the Pentagon struck back at the cyber attackers forcing them to reboot 
their computers. Since a counterattack had not been our intent, we were curious to know 
why this was reported. We tested the Java applet used by the Electronic Disturbance 
Theater against our site and discovered that it opened hundreds windows on the desktop 
computer, necessitating a reboot. This behavior may have been triggered by the DTIC 
system’s response to the applet. DTIC did not write any Java applet, contrary to the 
Reuters story. See Reuters story below: 


Pentagon Beats Back Internet Attack 
Thursday, September 10, 1998 
By Niall McKay 


SAN FRANCISCO (Wired) - The Pentagon struck back against Internet activists 
who attempted to hold an ‘online sit-in" Wednesday at the Defense Department's 
main Web site. 


The attack, which attempted to overwhelm the Web servers, also targeted sites for 

the Frankfurt Stock Exchange and the president of Mexico. ‘Our support 

personnel were aware of this planned electronic civil disobedience attack and were 

able to take appropriate countermeasures," said Defense Department b6 
(http://www.defenselink.mil) spokeswoman__ sd b7C per DTIC 


The group of Internet activists, who call themselves Electronic Disturbance 
Theater (http://www.nyu.edu/projects/wray/ecd.html), support the Zapatista rebels 
in Chiapas, fighting against the Mexican government. To draw attention to this 
cause, they attempted to temporarily disable certain Web sites by asking 
demonstrators to load a hostile Web-based program called FloodNet. 


But the Pentagon said that the FloodNet attack -- which attempts to overwhelm 
Web servers by requesting multiple pages simultaneously -- didn't get far. The 
Defense Department hinted that electronic countermeasures fended off the 
protesters. 


*“Measures were taken to send the countless demands from the attacker's servers 
into the great beyond," Hansen said. 


Participants in the FloodNet protest needed only to load the FloodNet Web page. 


The page contained a Java applet configured to request and load the three target 
Web sites every three seconds. The Electronic Disturbance Theater estimated that 
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up to 10,000 people took part in the demonstration, delivering 600,000 hits to each 
of the three Web sites per minute. 


The automated rapid-fire requests are designed to overwhelm the target Web sites 
so they cannot be viewed by their intended audience, known as a ‘‘denial of 
service" attack. 


The Pentagon's Web site support team apparently struck back with a Java applet of 
its own. That applet sensed requests from the FloodNet servers, and loaded-and 
reloaded-an empty browser window on the attacker's desktop. The move forced the 
protesters to reboot their computers. 


The Electronic Disturbance Theater declared the protest a success. 


‘Our interest is to help the people of Chiapas to keep receiving the international 
recognition that they need to keep them alive," said Brett Stalbaum, a member of 
Electronic Disturbance Theater and author of the FloodNet software. 


The group described its action as electronic civil disobedience -- a relatively new 
phenomena, according to a lecturer with the Department of Economics at 
University of Texas at Austin. 


“In a lot of ways it is simply the modern version of the tradition of civil 
disobedience," Harry Cleaver said ‘‘But there are a lot of problems associated with 
it. For instance, should US protesters have the right to protest on a foreign 
government's Web site?" 


For Stalbaum, the answer is yes. 


‘We protested the Mexican president's site for an obvious reason," he said. *‘We 
protested the Pentagon site because we believe that the US military trained the 
soldiers carrying out the human rights abuses at the School of the Americas." 


However the action at the Frankfurt Stock Exchange was a symbolic protest 
against globalization, which is at the root of the Chiapas' problems, according to 
Stalbaum. 


Officials at the Frankfurt Stock Exchange were aware of the protest but believed 
that it had not affected their services. "We get about 6 million hits a day," said a 
spokesman. *‘We were not aware of any reduction in services today." 


The action was funded by a $4,500 grant from TKTKTTmark, (pronounced 
‘‘artmark") an activist group dedicated to anti-corporate activism by channeling 
funds from donors to workers. 

(Reuters/Wired) 


http://news.lycos.com/stories/technology/wired/199809 1 Ortinternet-pentagon.asp 
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Detailed Summary: 


1) DTIC was alerted ahead of time of EDT's planned attack and was monitoring systems 
on the morning of Sept 9. One Domain was denied access at the router. 


2) The web server log files revealed an unusually large number of requests running the 
Fulcrum "multigate" search engine program. The terms in the search were suspiciously 
non-English and political. 


Examples: 


Gerechtigkeit dAtachement 

disinterest justice 

Gerechtigkeit fair-mindedness 

imparcialidad objectiveness 

AquitA giustizia 

dAtachement objectivity 

equality AquitA 

imparcialidad objetividad 

obiettivitA honneur 

human_rights fairness 

dignitA Gleichheit 

respecto objectiveness 
These requests were coming in at a rate that clearly implied a denial-of-service attack. 
3) In an attempt to filter out the denial-of-service attempts, changes were made in the 
html files on the DefenseLINK web site so that legitimate searches would have URL's 
that were subtly different from the URL's used by the attacking requests. 
4) A Perl program was created that detected the difference between legitimate URL's and 
attacking URL's. This program worked as a filter: It passed the legitimate search requests 
to the multigate program, but when it detected an attacking URL it returned the following 
message to the requester: 

Location: http://reload-your-search-page.please 


(The URL in this message points to a non-existent web server.) 


This filter program was inserted into the place of the "multigate" program so that all 
requests to the multigate program would flow through the filter program first. 


5) DTIC programmers tested the Java applet used by the Electronic Disturbance Theater. 


The applet opened hundreds of Java applet windows on one's desktop computer, 
consuming all CPU cycles. A power-off reboot was necessary to restore control. DTIC 
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programmers have surmised that this bad behavior may have been triggered by DTIC's 
use of the Location command, but that wasn't confirmed. 


7) DTIC did not write any Java applet, contrary to the Reuters story. 


8) After the filter was put in place 50,000 searches were turned away, submitted by 1500 
unique IP addresses. , 


Summ repared by: 


b6 
b7C per DTiIc 
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DESCRIPTIONS WWW.DTIC.MIL 


PER DIEM, utilized both by individual DoD employees and by DoD administrative 
organizations, provides the latest per diem rates, Basic Allowance for Housing, Overseas 
Housing Allowance, Overseas Cost of Living Allowance and other documentation issued 
by the Per Diem, Travel and Transportation Allowance Committee. Much of this 
information is frequently updated and the most recent releases are required for correct 
reimbursement computations throughout the DoD. The Defense Finance and Accounting 
System depends on this site for the data they utilize in calculating correct rates of 
payment. Even a brief disruption of access to this site could have far-reaching 
consequences throughout the Department. 


JOINT DOCTRINE is heavily used both by personnel involved in the development and 
utilization of doctrine and by the military schools to obtain electronic access to many key 
reference materials which are published on the site. These include such items as the DoD 
Dictionary, research papers, historical publications, specialized doctrinal publications, 
and numerous regulatory and guidance issuances. In many instances, access to these 
publications from a given location may be available only through this Web site, and lack 
of access would have a significant negative effect on a wide range of DoD activities. 


C3I includes internal memoranda and other key documents vital to the management of 
the Command, Control, Communications and Intelligence activities of the DoD. A large 
collection of Information Technology resource management information used throughout 
DoD is also accessed on the C3] site, such as reporting guidance, POM Preparation 
Instruction (PPI) information, links to the new IT reporting software, and tables specific 
to Information Technology reporting. In addition, this site is the official entry point for 
Year 2000 (Y2K) documents for the DoD, including the Y2K Management Plan, the 
DoD Y2K briefing, interface assessment workshop summaries, policy statements, and 
issuances from the C31 Senior Civilian Official’s office and the Secretary of Defense. 
Consolidated access to these documents allows more effective conduct of overall DoD IT 
processes as well as the critical Y2K process; lack of access would affect IT management 
throughout DoD. 


C3I BPR, incorporating the Electronic College of Process Innovation is a comprehensive 
set of documents, tools, and guidebooks on the topic of business process change and 
creating customer value. It provides specific tools to organizational change agentsand 
supplies senior executives with briefing materials and management information. Lack of 
access has the potential to affect numerous in-progress reengineering efforts. 


JCSLINK presents centralized access to a large compendium of information for and 
about the Joint Staff. In addition to the resources detailed above, under Joint Doctrine, 
JCSLink includes electronic versions of official regulations and instructions; the Joint 
Staff's electronic newspaper; recent speeches by the Chairman of the Joint Chiefs of 
Staff; his vision for America's Armed Forces in the 21st Century, Joint Vision 2010; and 
information on joint history, strategy, training and personnel. This mixture of types and 
sources of information provides a one-stop source for both DoD and external users which 


is not available in any other format; lack of access would hamper the actions of those 
who require this information for immediate utilization. 


STINET, the DTIC Scientific and Technical Information Network, offers 

the DoD community access to pertinent scientific and technical information to meet 
mission needs more effectively. The public Web site provides access to all unclassified, 
unlimited citations in the DTIC Technical Reports database since 1985, as well as many 
other unrestricted. DoD scientific and technical information resources. Curtailing access 
to STINET would affect not only the DoD, but also the Defense contractor and academic 
communities, which rely heavily on it as a source of research information. 


COMPTROLLER supplies the Financial Management Regulations (FMRs), which 
account for over 95% of the traffic on the site. The FMRs are used throughout the DoD 
to govern activities such as general financial management, budget presentation and 
execution, accounting, disbursing, military and civilian pay and travel, contract payment, 
reimbursable operations, special accounts funds and programs, nonappropriated funds, 
administrative control of appropriations, and security assistance. Without electronic 
availability of the current versions of the FMR, DoD activities cannot be assured of 
timely, accurate information on which to base financial activities. 


ENVIRONMENTAL CLEAN UP provides information to federal and local 
governments, the contractor community and the general public on DoD activities 
designed to reduce the risks to human health and the environment at active, formerly 
used, and closing bases, while ensuring that DoD environmental cleanup policy conforms 
to existing laws and regulations. If this information were not available for any period of 
time, the impact would be felt not only in DoD, but throughout the community affected 
by environmental clean up efforts such as individual states, local communities, and small 
businesses and other commercial concerns active in this area. 


DESCRIPTIONS WWW.DEFENSELINK.MIL 


DEFENSELINK is the top-level entry to all official DoD Web resources. It is widely 
used by DoD employees, the national and international media, and the world wide public. 
Overall, DefenseLINK averages 500,000 access weekly, and the loss of these resources, 
even for a short period would seriously impact many government and private-sector 
activities. Among the individual sections of DefenseLINK which are accessed most 
frequently are: News, Publications, Photos, Locator, and Questions. In addition to these 
DefenseLINK services, one of the subordinate sites, Office of the OSD General Counsel, 
receives a significant portion of the activity in this domain. (While the Comptroller site is 
also very active, as reflected above, it included in the DTIC.mil domain rather than in 
Defenselink.mil.) 


DEFENSELINK NEWS accounts for nearly 25% of the accesses to DefenseLINK, and — 
provides the latest DoD news, features and press information to the news media; the 
general public; other Federal and foreign government agencies; mililtary and civilianDoD 
employees, and military service family members; and Defense contractors. Material from 
this section is also delivered directly to subscribers through the News by Email service. 
Without the availability this site, the media would be denied timely access to developing 
news, the requirement to publish DoD contract awards would be unmet, memoranda for 
correspondents and press advisories which provide background and notification of events 
would not be published, live news briefings would not be broadcast, and the extensive 
archive of DoD Public Affairs issuances would be inaccessible. The damage created by 
even short-term lack of access to DefenseLINK News would be widespread, and would 
include the functions of the Office of the Assistant Secretary of Defense for Public 
Affairs (OASD(PA)), operations of domestic and foreign media agencies, civilian and 
military DoD employees, other government agencies, and the private sector contractor 
community. In addition, there is incalculable damage associated with stifling the free 
flow of information between the DoD and its various communities of interest. 


DEFENSELINK PUBLICATIONS provides centralized access to a broad variety of 
resources which originate within numerous sources and are used by a widely varied 
audience. Among the publications which are available are the OSD/Joint Staff Electronic 
Reading Room which is required by the Freedom of Information Act, 5 USC 
552(a)(2)(D), and links to other DoD electronic FOIA sources; general Defense personnel 
statistics, overall procurement statistics and trends, and geographical procurement 
information; individual reports issued by DoD on a variety of topics of high interest such 
as DoD restructuring, and base closure; the complete library of DoD Directives and 
Instructions, including downloadable forms; and other core reference materials required 
by DoD employees to perform their mission. Without the electronic availability of this 
information, access would be fragmented and, in some cases, impossible to achieve, 
affecting all DoD management and administrative functions, as well as the general 
public. 


DEFENSELINK PHOTOS is another heavily utilized portion of the DefenseLINK 
structure. It is the only means by which media organizations can obtain official DoD 


photographs electronically, and it is of vital importance to both the functions of 
OASD(PA) and the worldwide news media. If this service were not available, not only 
would there be considerable delay in the dissemination of the photos, which would be 
accomplished by photocopying and mailing or faxing them, but increased expense would 
be incurred by the DoD in performance of the necessary manual processing of photo 
requests. It has been estimated by OASD(PA) that a savings of approximately 
$1,500,000 per year, or over $4,000 per day, is realized by the Department in the 
electronic dissemination of photographs, so even a brief disruption of service would 
result in a significant financial loss. 


DEFENSELINK LOCATOR provides, among its other functions, access to the DoD 
implementation of the Government Information Locator Service as mandated by the 
Office of Management and Budget. In addition, to the Locator, the broader DefenseLINK 
search mechanism enables users to locate specific items within the DefenseLINK 
structure. A denial of service in this area would severely limit the ability to identify and 
retrieve required information, even if other portions of DefenseLINK were uninterrupted. 


DEFENSELINK QUESTIONS provides easy access to information most frequently 
required by the public. Its contents include information categories such as: military 
service academies, military installation information, recruiting, finding active duty 
members, getting copies of military records, Base Closures and Realignment (BRAC) 
information, Specifications and Standards, and information on contacting various offices 
within DoD. While this information may not be of vital importance in the conduct of 
DoD’s internal mission, it is of significance in providing information needed by 
individual members of the public, and lack of access would cause intangible harm to the 
“public face” of the Department. 


OSD GENERAL COUNSEL, in addition to general information about the office, 
presents detailed information concerning Defense Office of Hearings and Appeals 
(DOHA), and the Legislative Reference Service (LRS). The DOHA site supplies 
hearings and appeals information for individual programs, links to related sites, a direct 
email feature and includes a searchable collection of House and Senate bills, and links to 
other relevant documents, procedures, authorities, and processes. Publishing decisions of 
the DOHA is required by law (SUSC 552(a)(2) and SUSC 552(a)(2)(A)) to meet a 
specific provision of the Freedom of Information Act (FOIA) as amended in 1996, and 
the Department of Justice has indicated the Federal agencies should use the 
Internet/World Wide Web for electronic dissemination of records required to be made 
public under the FOIA. If the DOHA site were not available, the DoD would not be able 
to meet these legal and policy requirements. Additionally, the LRS portion of the site 
enables the DoD to respond to proposed legislation in a coordinated manner, including 
clearance with the Office of Management and Budget. Denial of access to the OSD 
General Counsel site would severely hamper these time-sensitive efforts and cause 
potential damage to DoD’s official communications with Congress. 


Web Statistics for Statistics for 980920 


PER DIEM 
23655 unique hosts. 
850.1 html pages per hour. 
20403 html pages each day.(Average estimate) 


JOINT DOCTRINE 
8582 unique hosts. 
512.4 html pages per hour. 
12298 html pages each day.(Average estimate) 


C3I 
7100 unique hosts. 
248.1 html pages per hour. 
5954 html pages each day.(Average estimate) 


C31 BPR 
4555 unique hosts. 
161.0 html pages per hour. 
3863 html pages each day.(Average estimate) 


JCSLINK 
4134 unique hosts. 
193.9 html pages per hour. 
4654 html pages each day.(Average estimate) 


STINET 
3329 unique hosts. 
59.1 html pages per hour. 
1417 html pages each day.(Average estimate) 


COMPTROLLER 
2896 unique hosts. 
213.3 html pages per hour. 
5119 html pages each day.(Average estimate) 


ENVIRONMENTAL CLEAN UP 
1637 unique hosts. 
50.3 html pages per hour. 
1207 html pages each day.(Average estimate) 


Web Statistics for Week Ending 98/09/05 


DEFENSELINK NEWS 


14874 unique hosts. 
565.9 html pages per hour. 
13582 html pages each day.(Average estimate) 


DEFENSELINK PUBLICATIONS 
13950 unique hosts. 
275.9 html pages per hour. 
6620 html pages each day.(Average estimate) 


DEFENSELINK PHOTOS 
7490 unique hosts. 
223.9 html pages per hour. 
5373 html pages each day.(Average estimate) 


DEFENSELINK LOCATOR 
4700 unique hosts. 
61.7 html pages per hour. 
1480 html pages each day.(Average estimate) 


DEFENSELINK FREQUENTLY ASKED QUESTIONS . 
2787 unique hosts. 
45.1 html pages per hour. 
1083 html pages each day.(Average estimate) 


OSD GENERAL COUNSEL 
2166 unique hosts. 
66.9 html pages per hour. 
1605 html pages each day.(Average estimate) 


Web Statistics for Week Ending 98/09/05 


PER DIEM 
23152 unique hosts. 
823.9 html pages per hour. 
19773 html pages each day.(Average estimate) 


JOINT DOCTRINE 
8370 unique hosts. 
426.4 html pages per hour. . 
10234 html pages each day.(Average estimate) 


C3I 
6423 unique hosts. 
226.4 html pages per hour. . 
5432 html pages each day.(Average estimate) 


C3I BPR 
3965 unique hosts. 
148.0 html pages per hour. 
3552 html pages each day.(Average estimate) 


JCSLINK 
3579 unique hosts. 
171.1 html pages per hour. 
4107 html pages each day.(Average estimate) 


STINET 
2825 unique hosts. 
56.4 html pages per hour. 
1354 html pages each day.(Average estimate) 


COMPTROLLER 
2602 unique hosts. 
218.5 html pages per hour. 
5244 html pages each day.(Average estimate) 


ENVIRONMENTAL CLEAN UP 
1656 unique hosts. 
97.1 html pages per hour. 
2329 html pages each day.(Average estimate) 


Web Statistics for Week Ending 98/09/19 


DEFENSELINK PUBLICATIONS 
17775 unique hosts. 
339.7 html pages per hour. 
8153 html pages each day.(Average estimate) 


DEFENSELINK NEWS 
16688 unique hosts. 
650.8 html pages per hour. 
15620 html pages each day.(Average estimate) 


DEFENSELINK PHOTOS 
8415 unique hosts. 
293.3 html pages per hour. 
7040 html pages each day.(Average estimate) 


DEFENSELINK LOCATOR 
5254 unique hosts. 
77.3 html pages per hour. 
1855 html pages each day.(Average estimate) 


DEFENSELINK FREQUENTLY ASKED QUESTIONS 
3286 unique hosts. 
54.1 html pages per hour. 
1297 html pages each day.(Average estimate) 


OSD GENERAL COUNSEL 
2361 unique hosts. 
80.8 html pages per hour. 
1939 html pages each day.(Average estimate) 


World Wide Web Services 


Defense Technical Information Center 
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22 October 1998 


DTIC WWW Servers ! 


Services Provided Example Sites 
¢ Static Web Pages @ DefenseLINK 
Dynamic Web Pages ¢JCSLink _ Pe oak © 
¢ Libraries @ Air Force Link |. WEB PAGE 
@ GulfLINK paar 


# Comment Forms 
Collaborative Tools 
# Document Review & 


@ S&T InfoWeb 
Early Bird 
Critical Infrastructure 


Coordination @ Comptroller 

¢ Multimedia (live | ¢ Personnel & Readiness 
broadcasts, audio, video)! » PerDiem 

¢ Full Text Search @ ArmyLINK 

Relational Databases Technology Navigator 


8 Separate Web Servers 
90 Primary Web Sites 
7 X 24 Operation 


7 A NN PRR OEE A RESON REE NERO I" OS Re 
et eee a iar F edie an z peas tes 
i Baha & ceed ne if rh et ee pees Bg bey abet 
cas wl Ae a Nae a } é a + winds ‘ x 
i oot ; . sca est 5 ; oP fe RE ee ee nae Sd Sear a 


Client 


DTIC WWW Usage 


User Communities Weekly Activity 
¢ DoD ¢ 3,000,000 Accesses 
¢ Intel Community @ 300,000 Unique visitors 
@ US Government @ 155,000 MB data delivered 
Contractors 
Education 
Media 
@ US Public 


@ International 


Public Access Web Services 
Limited Access Web Services 
(IP, DNS, or Password-restricted) 


Standard Processes 
for WWW Servers 


Server 


Client 


WEB SERVER 


WEB PAGE 


CISCO Router 


131.84.1.34 


132.52.1.99 IP Address 
www.defenselink.mil 


sysl.anna.net Domain Name 


| internet Protocol Address 
IP Address 


131.84.1.34 


Internet Address assigned to and used only by DTIC 


Extension of address used internally to locate devices 
connected to the network (computers, printers, servers) 


IP Address and Domain Names 
131.84.1.34 = www.defenselink.mil 


Domain names are “handles” that make systems more identifiable 


IP Addresses are registered with associated domain names at the 
~ Network Information Center 


These names are posted in an “address book” called the Domain 
Name Server available to internet computers 


Systems use IP addresses to look up the domain names 


Hyper Text Transfer Protocol 
HTTP Protocol 


Client Server 


WEB SERVER _, 


20 


wal \e The server processes the request and generates a response. 


~ mdse, The browser opens a connection to the server and sends a request. 


HTTP is a set of rules that allows a 
web browser and a web server to 
"talk" to each other. HTTP is 
based on a request/response model. 


Hyper Text Transfer Protocol 
HTTP Protocol 


The "Location" header is one of many HTTP instructional commands that the 
web server may pass to the browser. 


Hypertext Transfer Protocol -- HTTP/1.1 


Section 14.30 Location . 

The Location response- header field is used to redirect the recipient toa 
location other than the Request-URI for completion of the request or 
identification of a new resource. For 201 (Created) responses, the 
Location is that of the new resource which was created by the request. 
For 3xx responses, the location SHOULD indicate the server's preferred 
URL for automatic redirection to the resource. The field value consists of 
a single absolute URL. 


Location = "Location" ":" absoluteURI 
Example: 


Location: http:/Awww.w3.org/pub/WWW/People.html 


Standard Processes 
for WWW Servers 


Client Redirection = Location Header Server 
Print Location: http:www.af.mil/ 
WEB SERVER 


SEARCH 


CISCO Router 


www.af.mil 


Hacker 
Search Engine 


Legitimate Search Request 


Standard Security Practices 
for WWW Servers 


Search Engine Hacker Activity 
WEB SERVER. 


CISCO Router 


DetenseLINKy f 7 Dee “U.S. DEPARTMENT OF DEFENSE 


aa Home | Site Map Search 
MULTIMEDIA PUBLICATIONS QUESTION a? 


Security and Privacy Notice 
in tates “7 
1. | DefenseLINK i is provided as a public service by the Office of the Assistant Secretary of Defense-Public Affairs 
and the Defense Technical Information Center. 


2. Information presented on DefenseLINK is considered public information and may be distributed or copied unless 
otherwise specified. Use of appropriate byline/photo/image credits is requested. 


3. For site management, information is collected for statistical purposes. This government computer system uses 
software programs to create summary statistics, which are used for such purposes as assessing what information is 
of most and least interest, determining technical design specifications, and identifying system performance or 
problem areas. 


4. For site security purposes and to ensure that this service remains available to all users, this government computer 
system employs software programs to monitor network traffic to identify unauthorized attempts to upload or 
change information, or otherwise cause damage. 


5. Except for authorized law enforcement investigations, no other attempts are made to identify individual users or 
their usage habits. Raw data logs are used for no other purposes and are scheduled for regular destruction in 
accordance with National Archives and Records Administration guidelines. 


6. Unauthorized attempts to upload information or change information on this service are strictly prohibited and 
may be punishable under the Computer Fraud and Abuse Act of 1986 and the National Information Infrastructure 
Protection Act. 


7. If you have any questions or comments about the information presented here, please forward them to us using 
the DefenseLINK Contact Us page. 


Standard Security Practices 
for WWW Servers 


Search Engine Hacker Activity 


Filtered 
_ WEB SERVER _ 


CISCO Router 


Filters for Unix Commands 


Hacker 
Search Engine 


Legitimate Search Request 


Standard Security Practices 
for WWW Servers 


Hacker Activity 


Repeated Accesses 


Hacker 
Repeated 
Attack 


Filters Access to Servers 


CISCO Router 


Filters for Unix Commands 


Hacker 
Search Engine 


Legitimate Search Request 


Standard Security Practices 
for WWW Servers 


Hacker WEB SERVER 


Repeated “ 
Attack Filters Access to Servers KS 


| 


CISCO Router 


Filters for Unix Commands 


Hacker 
Search Engine 


Legitimate Search Request 


Denial of Service Attack 
9 September 1998 


Applet was designed to overload our Server | 
Complicated Searches were directed to Fulcrum Search Engine 


Repeated accesses from a single domain is not normal web usage. 
Access from Austrian Sub-Domain were deflected at router 
This approach would not work for other applet attackers 


DTIC Monitored Server Load 
Server Load was increasing and response times were slowing down 
By 9:00 a.m. server crash became a concern. 


Search engine filter was modified to deflect applet searches using 
standard Web redirection (location header) 


Additional Security Practices 
Taken for 
Denial of Service Attack 


Applet Filtered for Austrian WEB SERVER. 
Repeated sub-net to deny access. SORES 
Attack Filters Access to Servers SEARCH 4 Ve 


FORM, 
COEEEEEEE 


Filters for Unix Commands 
Filter for Specific Applet Request 


Internet 


CISCO Router 


Applet 
Search Engine 


Legitimate Search Request 


Denial of Service Attack 


Server Response: 
Location: http://reload-your-search-page.please 


RING Rare : oe BFRRE 


They should have 


PUBLICATIONS 


rece ived an fa ( Netocape is Unable to (ocate the server of D 
my iN web.delenselink.milThe serverdoes nithavea — 
error MeESsage ary ORE anti. | 


Check the server none inthe bocatian (UAL and | 
tr¥ aqain. 


like this: 


Applet: 


The applet opened hundreds of Java applet windows on an 
NT desktop computer, consuming all CPU cycles. A power-off 
reboot was necessary to restore control. DTIC programmers 
have surmised that this bad behavior may have been triggered 
by DTIC's use of the Location command, but that wasn't 
confirmed. 


Web Services 
on the | 
DTIC Production Web Server dtics14 


Web Service 


www.dtic.mil DTIC Web 
www.defenselink.mil DefenseLINK 
www.ngb.dtic.mil GuardLINkK 
WWW.)PCCID.gOov Critical Infrastructure Protection 
www.ciao.gov Critical Infrastructure 

| _& Assurance Organization 
rdss.dtic.mil R & D Streamlined 

| Solicitations/Contracts 

www.ctr.osd.mil Cooperative Threat Reduction 
doctrine.dtic.mil Joint Doctrine via password 


dtics14 ftp | upload 


alsa/pages/restrict/ 
audit/ 

bosnia/mail/ 
cnric/restricted/ 
c3i/infotech/index2.html 
c3i/infotech/software/ 
c3i/y2k/index2.html 
c3i/y2k/milgov/ 
jcs/jsirmo/ 
jcs/j4/papers/ 
compiroller/99budget/ 
crisisman/ 
ddre/internal/ 
ddre/wt/wtm/ 
doctrine/alt/ 
doctrine/interactive/ 
doctrine/jel/dftpubs/ 
doctrine/jel/ddrraafftt_pubs/ 
doctrine/jel/pd/draft_pd/ 
doctrine/jel/cjcsd/cjcs!/ 


DTIC Production Web Server 
IP- or DNS- or Password-restricted Directories 


doms/compio. 
doms/compio2. 
doms/compio/ 
doms/plans. 
doms/plans2. 
doms/caap/ 

dstp/ 

dsip/graphics/ 
dusage/ 
armylink/abs/inet/ 
jemp/calendar/restrict/ 
jwars/j-u-g96/ 
lablink/collab/ 
lablink/stcollab/ 
lablink/survey/ 
labman/director/ 
labman/survey/results/ 
milnews/ 

npr/af_strict/ 
npr/army_strict/ 


doctrine/jel/wkparty/aminutes/ npr/central_strict/ 


npr/dia_strict/ 
npr/dod_strict/ 
npr/finance_strict/ 
npr/investigative_strict/ 
npr/marine_strict/ 
npr/navy_strict/ 
npr/security_strict/ 
npr/strict_maint/ 
npr/transp_strict/ 
npr/whq_strict/ 
osdpa/ 

pbd/ 

pool/ 
share/devgroup/ 
share/directors/ 
share/cendi/ 
share/jdforum/ 
share/lii/ 


share/share2/tpso/ 
share/share2/gils/ 
share/share2/stcollab/ 
share/share2/vvte/ 
stinet/graylit/ 
technav/mgmt/ 
techtransit/calendar/restrict/ 
usage/ 

usage2/ 

/search97cgi/ 
photos/logs/ 
afd/military/ 
dodgcilrs/upload/ 
dodgcilrs/hold/ 
dodgc/Irs/archive/ 
dodreform/drids/ 
mirror/ . 
news/preview/ 


share/share2/devgroup/ index2.himl 
share/share2/cendiforum/ upload/ 


share/share2/jscc/ 
share/share2/rtatic/ 


meeting/ 


Web Access Log Records 


pm2e-1-224.innovsoftd.com - - [28/Jan/1996:00:00:01 -0500] "GET 
/airforcelink/pa/factsheets/Air_Force_News_Agency.html HTTP/1.0" 200 
16704"http://www.defenselink.mil/" "Mozilla/4.05 [enJC-MOENE (Win95; U)" 

206.100.165.189 - - [28/Jan/1996:00:00:02 -0500] "GET 
/airforcelink/pa/factsheets/C_5A_B_Galaxy.html HTTP/1.0" 200 8897 "http://www.defenselink.mil/" 
"Mozilla/4.05 [enJC-MOENE (Win95; U)" 

chs0061.awod.com - - [28/Jan/1996:00:00:03 -0500] "GET /bosnia/icons/bosnia_icon.gif HTTP/1.0" 
200 4292 

tyok088.bekkoame.or.jp - - [28/Jan/1996:00:00:04 -0500] "GET /defenselink/icons/di_search_icon.gif 
HTTP/1.0" 200 234 "http:/Avww.defenselink.mil/" "Mozilla/4.05 [enJC-MOENE (Win95; U)" 
206.100.165.189 - - [28/Jan/1996:00:00:06 -0500] "GET /airforcelink/pa/factsheets/pictures/co. gif 
HTTP/1.0" 200 14878"http:/Awww.defenselink.mil/" "Mozilla/4.05 [enJC-MOENE (Win95; U)" 
www-e3.proxy.aol.com - - [28/Jan/1996:00:00:06 -0500] "GET /defenselink/photos/01996_951228-F- 
4867P-003.htm!l HTTP/1.0" 200 1311 "http:/Avww.defenselink.mil/" "Mozilla/4.05 [enJC-MOENE 
(Win95; U)" 

ts02-and-08.iquest.net - - [28/Jan/1996:00:00:06 -0500] "GET /defenselink/icons/deflink_icon.gif 
HTTP/1.0" 200 4149 "http:/Awww.defenselink.mil/" "Mozilla/4.05 [enJC-MOENE (Win95; U)" 
wbpxy01.ne.mediaone.net - - [01/Sep/1998:00:01:26 -0400] "GET /cgibin/multigate/search 

_ ?h=search%2Fristhdr.htm&f=search%2Fristftr.htm&dl=search%2Fdl.txt&mt=240&ct=text%2Fhtml&ct= 
application%2Fx-native&s=dbname&md=15&mdt=1 00&rt=search%2Findex.rtp&dk= 

s1news&dk=s1 photos&dk=s1allpubs&dk=s1faq&dk=s1 gilshtml&dk=s1 otherinfo&dk=s1topstory&dk=s1 
admin&dk=s1soco&dk=s1Irs&dk=s1industry&dk=s1doha&dk=s1claims&dk=s 1 civilian&rt=search%2Fin 
dex.rtp&qs=audity HTTP/1.0" 200 5516 "http://Awww.defenselink.mil/" "Mozilla/4.05 [en]JC-MOENE 
(Win95; U)" 


Web Access Log Record 
What does it mean? 
Web Page Request 
pm2e-1-224.innovsoftd.com - - [28/Jan/1 996:00:00:01 -0500] "GET 


lairforcelink/pa/factsheets Air_Force_News_Agency.html HTTP/1.0" 200 16704 
"http://)www.defenselink.mil/" "Mozilla/4.05 [enJC-MOENE (Win95; U)" 


HE Domain Name/IP address of user 
Ml Date/Time of Login | 


M Location of information accessed | 

ME Status Code - 200 is OK - the request was filled 
#1 Size of file in bytes 

ME Referral - what web page request came from 


@ Agent - what type of browser was used 


Web Access Log Record 


What does it mean? 
Normal Search Request 


wbpxy01.ne.mediaone.net - - [(01/Sep/1998:00:01:26 -0400] "GET /cgibin/ 
multigate/search?h=search%2Fristhdr.htm&f=search%2F ristftr.htm&dl= 
search%2Fdl.txt&mt=240&ct=text%2Fhtml&ct=application%2Fx-native&s= 
dbname&md=15&mdt=100&rt=search%2Findex.rtp&dk=s1news&dk=s1 photos 
&dk=s1allpubs&dk=s1faq&dk=s1 gilshtml&dk=s1otherinfo&dk=s1topstory& 
dk=s1admin&dk=s1soco&dk=s1Irs&dk=s1industry&dk=s1doha&dk=s1claims 
&dk=s1civilian&rt=search%2Findex.rtp&qs=audity HTTP/1.0" 200 5516 
"http://www.defenselink.mil/" “"Mozilla/4.05 [en]JC-MOENE (Win95; U)" 


HM Domain Name/IP address of user 

MI Date/Time of Login 

MM Location of information accessed and search string 
MB Status Code - 200 is OK - the request was filled 

= Size of file in bytes 


ME Referral - what web page request came from 


= Agent - what type of browser was used 


Example Cyberattack Log Entry 


den-co58-100.ix.netcom.com - - [09/Sep/1998:00:47:28 -0400] "GET 
/cgi-bin/multigate/search?h=search%2Fristhdr.htm&f=search%2Fristftr.ht 
m&dl=search%2Fdl.txt&mt=240&ct=text%2Fhtml&ct=application%2Fx-native&s 
=dbname&md=15&mdt=100&rt=search%2Findex.rtp&dk=s1news&dk=s1photos 
&dk=s1allpubs&dk=s1faq&dk=s1 gilshtml&dk=s1 otherinfo&dk=s1topstory&dk 
=sladmin&dk=s1soco&dk=s1Irs&dk=s1industry&dk=s1doha&dk=s1claims&dk 
=s1civilian&rt=search%2Findex.rtp&qs=objectivittfairness HTTP/1.0" 200 - "-" 
"Mozilla/2.0 (compatible; MSIE 3.0; Windows 95)" * 


Mi Domain Name/IP address of user 

ME Date/Time of Login 

M Location of information accessed with search string 
MM Status Code - 200 is OK - the request was filled 

*s] Size of file in bytes 


ME Referral - what web page request came from eee 


M Agent - what type of browser was used 


Cisco Router Log Records 


Sep 9 09:03:57 dtic-gw2.dtic.mil 64996: %SEC-6-IPACCESSLOGP: list 103 
denied tcp 195.3.80.49(2061) -> 131.84.1.60(80), 1 packet 
Sep 9 09:03:59 dtic-gw2.dtic.mil 64997: %SEC-6-IPACCESSLOGBP: list 103 
denied tcp 195.3.80.82(2434) -> 131.84.1.60(80), 1 packet 
Sep 9 09:04:00 dtic-gw2.dtic.mil 64998: %SEC-6-IPACCESSLOGBP: list 103 
denied top 195.3.80.82(2432) -> 131.84.1.60(80), 1 packet 
Sep 9 09:04:02 dtic-gw2.dtic.mil 65000: %SEC-6-IPACCESSLOGP: list 103 
denied tcp 195.3.80.82(2434) -> 131.84.1.60(80), 1 packet 


| Cisco Router Log Records 
What does it mean? 


Sep 9 09:03:57 dtic-gw2.dtic.mil 64996: %SEC-6-IPACCESSLOGP: list 103 
denied tcp 195.3.80.49(2061) -> 131.84.1.60(80), 1 packet 


Date/Time of Login 
Our Router 
Event Sequence Number — 


Log type 


Access list that was used to filter accesses 
Could contain IP numbers or type of traffic (FTP, HTTP) 


Access was denied 


Protocol 


Inbound IP address and port number 


Inbound IP address and port number 


Inbound IP address and port number 


b6 
b7C 


[| | 


| have added some pages to my Power Point presentation to clear up some ambiguities. | have marked them with 
green tabs. os 


1-2 are background slides that fought would help people understand our web environment. erent 


3-4 discuss. Hyper Text Transfer Protocol HTTP -- the rules that allow web browsers and web servers to talk to one 
another. The specific text from the standard is provided. 


5 is the privacy and security notice that is used on DefenseLINK. There is a link to it on every page. Note b6é 
paragraph 4 and paragraph 6. This notice was coordinated with OSD General coma = Itwas also P7© Per DTIC 
published in the Federal Register. OMB and Department of Justice were in on the discussions. 


6-7 areto answer]___ |question about limited content on the web server. 6 shows the web services that all 

reside on a single hardware device with DefenseLINK. 7 is a listing of the directories on that hardware device that , . 

have access restrictions on them. Many of these are collaborative work spaces that are accessed only by a b7C per DTIC 
specific set of participants. There are many reasons we may want to restrict access: copyright, coordination, not 

yet cleared for public release... 


We contacted|_____________] During their Cyberattack the staff maintained watch over their system during the 
period ready to lockout specific IP sites if needed. As it turned out, they never had the inundation that was b6 
anticipated. BiG per Die 


On my lower level contacts at Justice, they have not yet responded to my request about the guidance they have 
received. 


Hope this helps. 


b6 
b7C per DTIC 


3447 den-co58-100.ix.netcom.com 
3274 195.3.80.46 
2861 useri1.seg/1.Ikclair.ucf.edu 
2664 dialup-sydax665.mpx.com.au 
1742 amb87034.casaccia.enea.it 
1475 195.3.80.39 
1251 iq-ind-as002-57.iquest.net 
1250 tnt1-145-51.cac.psu.edu 
1117 195.3.80.49 
1077 james.hut.fi 
1072 195.3.80.66 
1022 SL4.thing.net 
1003 pitone.geco.it 
905 195.3.80.65 
831 evil.aec.at 
714 195.3.80.82 
555 line43.slip.csx.cam.ac.uk 
545 sanfrancisco-as01-vt018.ca.compuserve.net 
523 ¢230.pce.net 
491 cable-195-162-197-65.customer.tvd.be 
473 aligator.quantum.de 
453 203.35.163.18 
430 203.63.219.2 
365 restel-maxint-236.dialup.ndak.net 
355 dadovago1039.dada.it 
325 SunSITE.icm.edu.pl 
284 SL2.thing.net 
278 usr63-dialup35.mix2.Boston.mci.net 
273 c145.pce.net 
267 socio.demon.co.uk 
259 COCOWHEAT-30.SLIP.ANDREW.CMU.EDU 
234 155.40.161.219 
224 sandside.demon.co.uk 
222 bix.thehub.com.au 
219 pc-fameli-e.idg.fi.cnr.it 
* 213 194.185.110.80 
210 195.3.80.97 
174 198.161.29.228 
174 line55.bingo.baynet.de 
173 193.170.69.72 
165 dadovago1118.dada.it 
164 cyber1 10-3.paris.imaginet.fr 
162 165-82-92-24 students.haverford.edu 
161 eepc117.ee.surrey.ac.uk 
146 pppethan.webslingerZ.com 
140 pm3p21.ichk.com 
138 bellbird.qut.edu.au 
128 200.32.67.41 
121 194.202.158.32 
119 144.92.169.234 
_ 119 X2modem162.digisys.net 
“408 193.76.219.3 


.0909sort 


107 cisco-ts15-line3.uoregon.edu 
107 pec-11.au1.wi.uunet.de 
105 208.240.147.82 

96 ip201-90.wiu.edu 

92 195.3.80.67 

90 usr03-17.provide.net 

87 tcp-relay-2.adobe.com 

86 stewart.SmallWorks.COM 
85 spider-wc042.proxy.aol.com 
78 waz.easynet.co.uk 

77 a85.Dynamic-IP.Mlink.NET 
73 194,.243.86.183 

73 zf8c7.aueb.gr 

72 |lpwa.com 

71 128.250.233.2 

69 moorlock.eorbit.net 

68 dnai-207-181-237-172.dialup.dnai.com 
67 office-32.balie.nl 

65 cacheflow1,gw.utexas.edu 
65 x1-6-00-60-97-6d-ac-2b.bc.edu 
63 195.67.67.98 

61 sprocket.dcn.davis.ca.us 

60 195.96.190.15 

57 gateway.spectrospin.ch 

57 mail.cpiprogetti.it 

56 ns.inm.de 

55 208-118-139.ipt.aol.com 

53 brescia-b60.numerica.it 

53 dial-in73.suffolk.lib.ny.us 

52 bowerbird.qut.edu.au 

50 ARPSTL-PROXY2.ARMY.MIL 
50 znrrr3-026.mcit.com 

49 proxy-len.om.com.au 

48 Atomas.Galea.Com 

48 m178.inf.unizar.es 

47 vincent.law.unc.edu 

44 gesualdoa.nexus.it 

44 jtg-eight-mac.well.ox.ac.uk 
44 udp004401uds.si.edu 

42 202.102.156.95 

42 204.61.76.110 

42 spider-wa013.proxy.aol.com 
41 n242-119.berlin.snafu.de 

40 proxy1a.lmco.com 

40 proxy3zhb.bluewin.ch 

38 restel-maxtnt-221 .dialup.ndak.net 
37 dc2-modem269.dial.xs4all.nl 
36 dodig.osd.mil 

35 SHORTCIRCUIT.MAC.CC.CMU.EDU 
35 lookout4-13.clis.com 

35 naxos.inf.unitn.it 

34 206.228.252.15 


0909sort 


34 gip-lausanne-nc.globalip.ch 

34 squid.fu-berlin.de 

33 131.36.168.209 

33 Portal2.West.saic.com 

33 inpub17.cc.nps.navy.mil 

32 194.95.161.99 

32 DLLSB102-38.splitrock.net 

32 edmund.cyberdesic.com 

32 ppp138.118.mmil.videotron.net 
32 usr18-121 .provide.net 

31 203.63.219.3 

31 204.184.62.49 

31 a-mi48-2.tin. it 

31 mail.exchange.de 

30 ppp207.distrito.com 

30 tlvscl.vim.tit.alcatel.it 

29 207-172-118-100.s100.tnt13.brd.erols.com 
29 cascade.cs.ubc.ca 

29 lummox.vip.best.com 

28 Go4iT.servus.at 

28 PPP181.gator.net 

27 129.29.109.207 

27 den-co70-124.ix.netcom.com 
27 plsi0O29.mscd.edu 

27 pub-10-a-4.dialup.umn.edu 

26 168.39.128.232 

26 ppp47.usrtc( .carleton.ca 

25 86-225.cnet.com 

25 Portal.East.saic.com 

25 avgate.army.cz 

25 finch-06.www-cache.demon.co.uk 
25 sam.cyberdesic.com 

24 rochester-35.slip-uiuc.edu 

24 ts044p1.tlv.netvision.net.il 

23 PC40740.MAC.CC.CMU.EDU 
23 TC1-dial-61-142.oldslip.inch.com 
23 nyc-ny79-12.ix.netcom.com 
23 phonak11.phonak.ch 

22 204.252.7.239 

22 client-151-197-11 1-131 .bellatlantic.net 
22 dd37-203.dub.compuserve.com 
22 mir.ee.surrey.ac.uk 

22 usero878.uk.uudial.com 

21 198.25.159.251 

21 ns1.osan.af.mil 

21 pc633.ncsc.navy.mil 

21 pdx-pm1-p33.coho.net 

21 ppp-51x2-0407.mtl.total.net 
20 194.109.8.253 

20 nhchost-199.nhc.navy.mil 

20 p33-max23.akl.ihug.co.nz 

20 pc324.cpms.osd.mil 


0909sort 


20 proxyca2.grolier.fr 

20 sarppp6.net.usf.edu 

19 194.230.54.5 

19 198.85.68.14 

19 216.13.11.98 

19 m4407-fw1 .ftmeade.army.mil 
19 saturn.inm.de 

18 49.thmax-5.dial.ftech.co.uk 
18 192.31.20.199 

18 dynip102.efn.org 

18 fw-ext.vnp.odn.net 

18 gate1 .cpp.usme.mil 

18 nomad.dial.eunet.ch 

18 ppp179.198.redestb.es 

18 valencia10.cim.es 

17 dyn026d.egr-ri.ids.net 

17 iq-ind-asO06-11.iquest.net 
17 p0016c41.us.kpmg.com 
16 131.44.27.191 

16 166-93-76-175.rmi.net 

16 194.184.89.23 

16 195.175.107.72 

16 andromeda.dir.co.jp 

16 di08qOna7.nycap.rr.com 
16 mhiguardian.mhi.co.jp 

16 pd03-083.par.compuserve.com 
16 pm3-118.netgate.net 

15 146.58.22.26 

15 195.42.130.58 

15 RTG3.MIT.EDU 

15 d-ri-providence-57.ici.net 
15 dyn-008.ke.allgaeu.org 

15 krusty.keesler.af.mil 

15 ns.jsc.go.jp 

15 ppp-asok02--079.sirius.net 
15 proxy-gw.fs.Imco.com 

15 smf-staff2.facsmf.utexas.edu 
15° ws19.ccp.martinet.net 

14 143.81.8.181 

14 150.113.53.139 

14 204.218.210.43 

14 208.197.166.61 

14 209.61.94.98 

14 cx65249-a.di1.sdca.home.com 
14 dhcp-20-73.UCSC.EDU 

14 line19.slip.csx.cam.ac.uk 
14 modem-206.peterboro.net 
14 ppp0002.nb.gibralter.net 
14 wpmsc01 .wpafb.af.mil 

13 137.246.34.156 

13 155.150.190.63 

13 192.116.98.114 
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13 WS-2300R2068-7.dm.af.mil 
13 cache.pressroom.com 

13 donhqns5.hq.navy.mil 

13 ha0068.ha.osd.mil 

13 Ift35.kelly.af.mil 

13 ppp-mar156.ath.forthnet.gr 
13 sys123.dtic.mil 

13 utslc-fw.ang.af.mil 

13 ws151045.ramstein.af.mil 

12 192.204.76.89 

12 205.233.216.116 

12 207.239.66.193 

12 38.233.90.254 

12 hqda224-95.army.pentagon.mil 
12 lak-proxy-1 .lakenheath.af.mil 
12 pentagon-ascend-ppp35.nosc.mil 
12 pm202.Ilvnworth.com 

12 px.acuity.com 

12 scunfw0001.hq.southcom.mil 
12 usr-tc-02-144.win.net 

12 zeus.sabre.net 

11 129.52.51.45 

11 134.80.110.191 

11 137.51.82.67 

11 193.212.51.219 

11 195.103.82.150 

11 203.146.45.92 

11 209.64.37.92 

11 ARPSTL-PROXY1.ARMY.MIL 
11 cmtn051p13.mtn.micron.net 
11 cs2.catv.ne.jp 

11 dialup-108.melb.ozramp.com.au 
11 geertjan.mediamatic.nl 

11 io.starnet.gov.sg 

11 jbt-53 jbt.slu.se 

11 jdagw.admix.go.jp 

11 maclab23.huntingdon.edu 
11 ness.dgsys.com 

11 sirinc.com 

10 160.134.120.160 

10 166.112.203.8 

10 1Cust96.tnt1 .sfo1.da.uu.net 
10 206.15.63.170 

10 206.4.65.3 

10 207.22.105.194 

10 49.p1.Tnt01.MIA.Icanect.Net 
10 dhcp180-41 .fp.trw.com 

10 dhcp73.asc2a.langley.af.mil 
10 m_33_67.pppmad.vsnl.net.in 
10 p-sale10.hydranet.it 

10 pcddip.pa.osd.mil 

10 ppp-101.alex.it 
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10 ppp-207-214-211-196.sntc01.pacbell.net 
10 smcnamara-pc.jawp.ida.org 
10 spider-wa033.proxy.aol.com 
10 spider-wg031 .proxy.aol.com 
10 underbelly.demon.co.uk 
10 unknown-32-212.rand.org 
10 wondra.garev.uga.edu 
10 x130-65-200-18.sjsu.edu 
10 ztm99-17.Zoetermeer.NL.net 
9 1161-5.dinfos.osd.mil 
9 129.200.62.6 
9 140.156.93.65 
9 155.40.163.179 
9 160.147.171.51 
9 174-236-64.ipt.aol.com 
9 17TRWPA.goodfellow.af.mil 
9 198.109.164.221 
9 1Cust235.tnt9.sfo3.da.uu.net 
9 207-172-70-177.8177.tnt11.brd.erols.com 
9 207.179.11.187 ; 
9 208.28.231.199 
9 SL9.thing.net 
9 WGCREECH.med.navy.mil 
9 area342.pae.osd.mil 
9 cse4-39.kawaguchi.mbn.or.jp 
9 d06.kwa-usr1 .nisiq.net 
9 dal03-13.ppp.iadfw.net 
9 den-co62-42.ix.netcom.com 
9 dkstreet-a6768.apgea.army.mil 
9 hrob.ne.mediaone.net 
9 kflex01-35.aug.com 
9 mail.dom.de 
9 mitre-gk1.hanscom.af.mil 
9 net? .elmendorf.af.mil 
9 newhouset119.erols.com 
9 port-25-46.access.one.net 
9 ppp039.ms.centuryinter.net 
9 ppp29.norfolk.navy.mil 
9 proxy3a.lmco.com 
9 sungold2.de.ibm.com 
9 swl171.va.grci.com 
9 sys128.dtic.mil 
9 wp.eris.dera.gov.uk 
9 ww-to04.proxy.aol.com 
8 152.72.238.205 
8 160.149.192.67 
8 192.106.90.134 
8 192.204.76.62 
8 1Cust6.tnt3.redondo-beach.ca.da.uu.net 
8 1Cust84.tnt18.nyc3.da.uu.nét 
8 204.149.38.230 
8 3.detroit-05.mi.dial-access.att.net 
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8 52.arlington-46-47rs.va.dial-access.att.net 
8 COMP-027.arcent.army.mil 

8 WALKER-TS12.KOREA.ARMY.MIL 
8 a-ca9-565.tin. it 

8 afin-gw.howard.af.mil 

8 afotec.af.mil 

8 az162-fw.ang.af.mil 

8 brann.nswe.navy.mil 

8 dhcp-193.i.gol.co.jp 

8 dhcp159.afnews.af.mil 

8 dhorvath.ekstrom.louisville.edu 

8 gcsin1.gecm.com 

8 kkhan-5115-d1.hq.usace.army.mil 
8 newhouset110.erols.com 

8 nobody.dasburo.de 

8 pgh139.fyi.net 

8 pm0101-24.promedia.net 

8 pool050-max7.ds12-ca-us.dialup.earthlink.net 
8 proxy.transnet.de 

8 tartarus.lib.nps.navy.mil 

8 viper.gao.gov | 

8 ww-to02.proxy.aol.com 

7 129.48.152.98 

7 137.245.78.54 

7 140.139.101.132 

7 140.183.99.240 

7 145.60.77.1 

7 146.142.36.226 

7 199-170-160-154.la.inreach.net 

7 1Cust56.int16.atl2.da.uu.net 

7 204,.32.2.149 

7 207-172-99-178.s178.tnt13.ann.erols.com 
7 LOFTISLG.ws.afrl.af.mil 

7 MALLEYS.forscom.army.mil 

7 PC-145180.Misawa.AF.MIL 

7 TWHAWKINS.med.navy.mil 

7 cf-sec.itjit.ad.jp 

7 d203-vi101h1-vcta-pdi.attcanada.net 
7 digger1.defence.gov.au 

7 gauntlet-out.aporter.com 

7 halifax.lancs.ac.uk 

7 harvard.cheyennemountain.af.mil 

7 host.205-130-239-138.gsa.gov 

7 ia142102.hq.af.mil 

7 mail.66mi.darmstadt.army.mil 

7 maria.fi-b.unam.mx 

7 pci69.nls.uk 

7 pool013-max8.ds17-ca-us.dialup.earthlink.net 
7 portsc27.northcoast.com 

7 ppp-milano66-240.iol.it 

7 ppp47-89.dial.nildram.co.uk 

7 proxy2ah.powerup.com.au 


7 relay.nima.mil 

7 shadow.dra.hmg.gb 

7 sia-svr01.sia-av.it 

7 ucdps00.js.pentagon.mil 

7 usarc-fw.army.mil 

7 w2116.naskef.navy.mil 

6 132.252.180.1 

6 134.11.7.29 

6 134.131.160.130 

6 134.80.108.153 

6 136.207.217.210 

6 140.156.101.69 

6 151.112.22.99 

6 155.155.4.51 

6 170-106-96.ipt.aol.com 

6 194.125.62.69 

6 194.125.62.70 

6 194.95.216.215 

6 206.142.111.231 

6 206.39.152.219 

6 207.112.18.153 

6 207.197.158.74 

6 208.206.219.217 

6 208.230.114.138 

6 2Cust78.tnt1.dca1.da.uu.net 
6 31.gate1.misawa.attnet.or.jp 
6 BETTS.bliss.army.mil 

6 MMDNT11.med.navy.mil 

6 OAK.TRC.DSWA.MIL 

6 PPPa26-OaklandB1-2R358.saturn.bbn.com 
6 W69FMA04.andersen.af.mil 
6 bath-net.futurenet.co.uk 

6 cdt12.cdt.org 

6 csci-va.com 

6 d27.dial-6.cmb.ma.ultra.net 
6 dial-pri-zu227.active.ch 

6 dialup08ip063.tus.azstarnet.com 
6 dialup165-2-17.swipnet.se 
6 dvorakd.randolph.af.mil 

6 firewall.msc.navy.mil 

6 fw.nctssd.navy.mil 

6 garlic.wwwcache.ja.net 

6 hcheilek-pc.sed.ida.org 

6 hsu55315.humboldt.edu 

6 jIn99.janics.com 

6 1da308431.kelly.af.mil 

6 mac143.BanffCentre.AB.CA 
6 madmax-143.sfsu.edu 

6 madmax-94.sfsu.edu 

6 mailhost.385sig.kuwait.army.mil 
6 mangw.nsanaples.navy.mil 
6 news.ti.com 


6 pc-093.wpc.af.mil 

6 piweba8y-ext.prodigy.com 

6 ppp-208-18-65-148.wchtks.swhell.net 
6 proxy2b.Imco.com 

6 pwewashhost4-33.pwewash.navy.mil 
6 salem30-12.aorcentaf.af.mil 

6 satujan-i.pp.kolumbus.fi 

6 set.malmstrom.af.mil 

6 sogno.datanord.it 

6 spider-ti043.proxy.aol.com 

6 spider-wa042.proxy.aol.com 

6 tkb0165.bekkoame.or.jp 

6 user072068.aos.langley.af.mil 

6 vp210-133.worldonline.nl 

6 w19.CLAS.berkeley.edu 

6 washingtondc-2.navtap.navy.mil 
5 1161-6.dinfos.osd.mil 

5 128.146.186.184 

5 131.44.81.220 

5 150.114.152.167 

5 18-pstn.rotterdam.luna.net 

5 193.59.147.226 

5 199.122.49.193 

5 1Cust34.tnt21.dfw5.da.uu.net 

5 20.4.210.180 

5 205.169.118.9 

5 206-104-98.ipt.aol.com 

5 207.107.99.10 

5 207.60.8.104 

5 208.222.21.1 

5 208.234.42.72 

5 209.8.116.61 

5 31.nashville-03-04rs.tn.dial-access.att.net 
5 Access-ISDN1-45.aa.psu.edu 

5S DHCP44-114.0TSG.AMEDD.ARMY.MIL 
5 EMIC3.carlisle.army.mil 

5 Elvis.nellis.af.mil 

5 anders.omnilink.net 

5 bendrath.dialup.fu-berlin.de 

5 cig.defence.gov.au 

5 cits-pr-1.hill.af.mil 

5 cs304645-a.cghy1.ab.wave.home.com 
5 ebinbh1.ms.com 

5 eisel.hq.usace.army.mil 

5 gasav-fw.ang.af.mil 

5 gate1.iwz.usme.mil 

5 gate2.cpp.usmec.mil 

5 gatekeeper.kvaerner.no 

5 gw.kntv.com 

5 kyo020.ap.mind.ne.jp 

5 marse7-241.abo.wanadoo.fr 

5 netprox.nu.com 


5 palisade.spacecom.af.mil 

5 pc227.net41.vicenza.army.mil 
5 pcdesf.pa.osd.mil 

5 penu3466.cnet.navy.Mil 

5 piweba2y-ext.prodigy.com 

5 proxy-225.iap.bryant.webtv.net 
5 proxy-jkt.telkom.net.id 

5 proxy04.spidernet.net 

5 proxy1b.Imco.com 

5 rdsdpc32.nri.navy.mil 

5 rommel.logis-tech.com . 
5 ruh-pawww.eskan.swablack.af.mil 
5 schwarma.bahrain.navy.mil 
5 sjas-21-1-17.sj.bigger.net 

5 snowwhite.GrandForks.af.mil 
5 sped4-113.dde.dla.mil 

5 spider-te064.proxy.aol.com 
5 spider-wj022.proxy.aol.com 
5 stelle.silverserver.co.at 

5 thing.at 

5 useri135.s154.samsung.co.kr 
5 user33.seg1 .Ikclair.ucf.edu 

5 userp647.uk.uudial.com 

5 vafire.feldinc.com 

5 vsp047486.ncr.disa.mil 

5 ws131236.ramstein.af.mil 

5 www.aiphone.com 

5 x2-usr3.ppp225.webzone.net 
4 131.137.109.137 

4 131.137.255.6 

4 131.36.147.250 

4 132.159.110.81 

4 134.80.47.40 

4 136.215.192.37 

4 137.217.96.23 

4 138.180.16.51 

4 138.230.48.18 

4 144.170.100.109 

4 147.35.213.239 

4 150.113.72.149 

4 151.166.205.3 

4 156.40.116.132 

4 158.11.173.52 

4 160.147.70.114 

4 164.159.154.239 

4 177.orlando-04.fl.dial-access.att.net 
4 192.153.134.165 

4 193.127.62.253 

4 194.100.58.3 

4 195.29.253.34 

4 198.97.197.202 

4 198.97.198.92 
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4 199.120.25.98 

4 199.122.45.144 

4 1Cust165.tnt14.sfo3.da.uu.net 
4 1Cust47.tnt1.ewr1 .da.uu.net 

4 203-56-63.ipt.aol.com 

4 204.44.134.105 

4 207-172-120-237.s237.tnt14.brd.erols.com 
4 207-9-250.ipt.aol.com 

4 209-165-1-217.lightspeed.net 

4 209-27-222-57 lightspeed.net 

4 209.176.133.250 

4 32f24b574.dgsc.dla.mil 

4 43.gate1.yokota.attnet.or.jp 

4 BERMINGJ.forscom.army.mil 

4 DHCP186-144.DMHRS.MEPRS.AMEDD.ARMY.MIL 
4 Host-614.I-Dial.de 

4 NAT058.nationalpress.com 

4 SVWWWO007.STL.MO.BOEING.COM 
4 USNH.med.navy.mil 

4 WS-OGOSS-102. offutt.af.mil 

4 X2modem122.digisys.net 

4 YNGLFOSSESCA. yng. aires.af.mil 
4 a-ba9-45.tin.it 

4 aa7-p58-zg.tel.hr 

4 alto2.mfi.com 

4 alvinrsc.whoi.edu 

4 asc-15-addr-230.dsuper.net 

4 ase17.wpatb.af.mil 

4 bunker.grsoc.gordon.army.mil 
4 cache-da04.proxy.aol.com 

4 cache-da05.proxy.aol.com 

4 dadovago1117.dada.it 

4 deptvass2-bh.va.gov 

4 dhcp033086.scott.af.mil 

4 dial-46.r07.tngnbo.infoave.net 
4 ducksoup.ko.kcp.com 

4 dynamic20.pm02.sf3d.best.com 
4 e37.Dynamic-IP.Mlink.NET 

4 eg-018-073.eglin.af.mil 

4 ellertbeckm.hq.af.mil 

4 erbium-asy-8.rutgers.edu 

4 ev-9d9.aaa.army.mil 

4 external.atpco.com 

4 firewall.scott.af.mil 

4 gate1.clb.usmc.mil 

4 gatekeeper.nctsw.navy.mil 

4 haabassa-49.mdm.mad.execpc.com 
4 host22.tic.igc.org 

4 ind1-cs-11.win.bright.net 

4 inter1032.internet.com.mx 

4 inter783.internet.com.mx 

4 interlock.arinc.com 
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4 jml212.dmlss.detrick.army.mil 

4 jptilghm-a3315.apgea.army.mil 
4 loxppp5-It19.Lumpini.loxinfo.net 
4 tyon114.dtr.fr , 
4 magellan.ign.com.au 

4 mrypm31-p126.netexp.net 

4 nst.mtu.ru 

4 0918-85.kadena.af.mil 

4 onramp5-13.onr.com 

4 p0016c45.us.kpmg.com 

4 p325031a.gordon.army.mil 

4 pc29.nctspr.navy.mil 

4 pcddil.pa.osd.mil 

4 pentagon-pc2.army.pentagon.mil 
4 portal.east.saic.com 


4 ppp-207-214-211-90.sntc01.pacbell.net 


4 ppp117.Ath5-1.Hellasnet.GR 
4 ppp128.citilink.com 

4 ppp145.hgea.org 

4 ppp47-222.dial.nildram.co.uk 
4 ppp76-cs1.sanet.ge 

4 qirmseyj-Old.hqpacaf.af.mil 
4 rossand.unipv.it 

4 saf169225.hq.af.mil 

4 sdn-ar-001okocitP 1 18.dialsprint.net 
4 spider-ta023.proxy.aol.com 
4 st-114.dsmc.dsm.mil 

4 sys599.dtic.mil 

4 t-cssc-9-3-p7.dialup.wisc.edu 
4 tulsa.dis.anl.gov 

4 unknown-32-195.rand.org 

4 user-38ld7km.dialup.mindspring.com 
4 w184.dfi-intl.com 

4 wrightl.pr.osd.mil 

4 ws132003.aviano.af.mil 

4 zama-40pc68.army.mil 

3 03.gate1 .iwakuni.attnet.or.jp 
3 12505rrubio.ssp.nmfs.gov 

3 128.158.182.243 

3 128.244.219.256 

3 129.171.59.176 

3 129.52.81.134 

3 131.32.153.161 

3 131.45.31.27 

3 131.55.173.100 

3 131.614.122.118 

3 134.205.50.19 

3 137.244.94.218 

3 137.9.254.156 

3 138.50.197.70 

3 139.84.34.7 

3 143.138.70.179 
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3 143.231.164.21 

3 144.170.184.232 

3 144.170.204.220 

3 147.39.200.251 

3 150.137.86.101 

3 150.190.109.102 

3 155.147.190.37 

3 155.155.200.163 

3 155.9.222.29 

3 160.147.140.173 

3 160.147.140.221 

3 160.147.145.121 

3 160.150.33.119 

3 160.150.70.25 

3 160.150.70.49 

3 164.117.155.165 

3 165.212.216.4 

3 165.224.84.83 

3 165.229.56.177 

3 1831 CRAGAN.facso.navfac.navy.mil 
3 192.108.183.26 

3 194.209.90.245 

3 194.79.110.4 

3 195.142.234.10 

3 198.201 .22.193 

3 199.122.49.179 

3 1Cust14.tnt2.clei.da.uu.net 
3 1Cust17.tnt6.dfw5.da.uu.net 
3 1Cust47.tnt4.nyc3.da.uu.net 
3 1Cust53.tnt13.lax3.da.uu.net 
3 1Cust99.tnt3.tampa.fl.gt.uu.net 
3 202-55-16.ipt.aol.com 

3 203.254.94.117 

3 204.17.70.1 

3 205.156.133.254 

3 205.252.42.203 

3 206.204.34.37 

3 206.39.14.205 

3 206.39.30.59 

3 207-wn_hiper1.wn.net 

3 208.128.99.211 

3 208.206.170.214 

3 209.118.30.43 

3 209.22.221.2 

3 209.77.167.195 

3 212.62.132.18 

3 55.90.10.7 

3 A0024843.dscc.dla.mil 

3 AISMO.hgi.usme.mil 

3 AKRNB107-18.splitrock.net 
3 AMEDD170133.CS.AMEDD.ARMY.MIL 
3 AWC3-64.au.af.mil 


3 BHCOLLETTI.med.navy.mil 

3 C168.usfj.navy.mil 

3 C219.usfj.navy.mil 

3 CB-A03-pool-186.tmns.net.au 

3 CITS-PROXY.moody.af.mil 

3 DC-24-137.bpb.bigpond.com 

3 DialPPP-3-117.rz.ruhr-uni-bochum.de 
3 Dialup-524.HIP.CAM.ORG 

3 FSLF45.fsw.LeidenUniv.nl 

3 GB632H.carlisle.army.mil 

3 JB-fwia.ser.netvision.net.il 

3 LSB917-2.LSB.State.MI.US 

3 LWSHOOK.med.navy.mil 

3 MI18.initco.net 

3 NEWINSTALL.orh.usace.army.mil 
3 OLEXAT.pafb.af.mil 

3 PENNE.NAPLES.NAVY.MIL 

3 SL14.thing.net 

3 SOLISD.forscom.army.mil 

3 WS-2300R2089-4.dm.af.mil 

3 akr-romp-58-202.raex.com 

3 anc-p23-108.alaska.net 

3 as1-p103.tfs.net 

3 as5300-7-54.roc.ny.frontiernet.net 
3 ascacc03.erols.com 

3 blowsbox.cscc.net 

3 ca560473.eglin.af.mil 

3 cache-db06.proxy.aol.com 

3 cc36553.navsea.navy.mil 

3 chf-il5-01 .ix.netcom.com 

3 cinosan.ncr.disa.mil 

3 cits-fw-1-ext.pope.af.mil 

3 client-151-200-124-224 bellatlantic.net 
3 client-151-204-207-2.bellatlantic.net 
3 coltont.hill.af.mil 

3 cpmrkc.comanche.redstone.army.mil 
3 ctv21225131135.ctv.es 

3 darianog.hill.af.mi 

3 das11.ucls.uchicago.edu 

3 davis.friends.edu 

3 desdemona-75.cableol.net 

3 dia1.chase.com 

3 dialup86-10-8.swipnet.se 

3 disan045433.ncr.disa.mil 

3 dns12.dfas.mil 

3 du15-243.ppp.algonet.se 

3 dyna-zg-21 .dial.eunet.ch 

3 eb-pm1-24-56.dialup.slip.net 

3 exodus.mke.ra.rockwell.com 

3 faculty154.csum.edu 

3 finch-09.www-cache.demon.co.uk 
3 gate1.ala.usmc.mil 
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3 gate1.bam.usmce.mil 

3 gate1.rrds.co.uk 

3 gate2.clb.usmc.mil 

3 gate2.quantico.usmc.mil 

3 gbarbrook.demon.co.uk 

3 giglio3c965.secdef.osd.mil 

3 gw.dayzim.com 

3 gw3.tcusa.com 

3 h-208-12-39-132.netscape.com 
3 host187.infoxpress.com 

3 host3445.acq.osd.mil 

3 hqda2-160.army.pentagon.mil 
3 irpsws125.ucsd.edu 

3 jaguar.andrews.af.mil 

3 joelly.pica.army.mil 

3 Icsc2665.Icsc.edu 

3 leone.ethz.ch 

3 Igxx-4b323-06.hq.af.mil 

3 1Ir13750.littlerock.af.mil 

3 luey.nawcad.navy.mil 

3 Ivg-ras2-19-161 .thegrid.net 

3 ly048092.robins.af.mil 

3 mail.eci-esyst.com 

3 max1-ppp9.fukuoka.sannet.ne.jp 
3 md44-211.mun.compuserve.com 
3 msjanfw.ang.af.mil 

3 netb37.bah.com 

3 netport3-57.iu.net 

3 octopus6.nrl.navy.mil 

3 odo.belgium.eu.net 

3 p3-80.senate.gov 

3 pc-1026.hq.af.mil 

3 pc139.nhre.navy.mil 

3 pc212-166.lewis.army.mil 

3 pent3a1062-8.hq.af.mil 

3 pm22.t0.or.at 

3 pm2e2s18.skipnet.com 

3 pm3ps7.ritzcom.net 

3 pool0006-max3.ucla-ca-us.dialup.earthlink.net 
3 pop.eia.org 

3 ppp-207-193-13-5.hstntx.swbell.net 
3 ppp166.the.forthnet.gr 

3 ppp9.ntticc.or.jp 

3 relay.parliament.uk 

3 rub129.to00.pv.interbusiness. it 
3 samdss02.comm.hq.af.mil 

3 smi2-34.corridor.net 

3 spe54-64.ddc.dia.mil 

3 spe81-61.dde.dla.mil 

3 spe88-123.ddc.dla.mil 

3 spider-pa033.proxy.aol.com 

3 spider-tm064.proxy.aol.com 


3 spider-tm074.proxy.aol.com 
3 spider-tn024.proxy.aol.com 
3 spider-tn062.proxy.aol.com 
3 spider-tn071.proxy.aol.com 
3 spider-to052.proxy.aol.com 
3 spider-tp012.proxy.aol.com 
3 spider-wa062.proxy.aol.com 
3 spider-wg023.proxy.aol.com 
3 std126.dorms2.macalester.edu 
3 stsacspci17.stewart.army.mil 
3 styx.viaginterkom.de 

3 tc-1-080.ariake.gol.ne.jp 

3 tc1.bora.net 

3 than.tcp.ca 

3 tkb0164.bekkoame.or.jp 

3 tmpce001 .alliedsignal.com 
3 uc184245.eucom.mil 

3 unknown-31-128.ssd.loral.com 
3 unknown-32-87.rand.org 

3 user-151.sim.fiber.net 

3 user-38s052j.dialup.mindspring.com 
3 vaiko.usislib.ee 

3 viper.usafa.af.mil 

3 williams.store.unc.edu 

3 ws.msosa.dmso.mil 

3 ws105196.ramstein.af.mil 

3 ws185035.ramstein.af.mil 

3 wse24pub96.bluewin.ch 

3 ww-tm04.proxy.aol.com 

3 ww-tn04.proxy.aol.com 

3 ww-to01.proxy.aol.com 

3 ww-ip01.proxy.aol.com 

3 ww-tp02.proxy.aol.com 

3 www-proxy.eunet.ch 

3 y41.c2.cboss.com 

3 zama-40pc19.army.mil 

3 zeus.unitel.co.kr 

2 1161-2.dinfos.osd.mil 

2 128.160.98.83 

2 129.246.83.79 

2 129.52.75,.222 

2 131.158.23.238 

2 131.74.197.68 

2 132.159.93.213 

2 132.159.99,251 

2 132.27.210.69 

2 132.29.123.74 

2 132.83.5.108 

2 134.11.131.149 

2 134.131.64.44 

2 134.136.47.21 

2 134.152.38.171 
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2 134.78.58.29 

2 136.205.50.30 

2 137.240.43.34 

2 137.245.196.15 
2 137.3.141.108 

2 138.110.232.174 
2 138.27.36.192 

2 140.154.29.25 

2 140.183.215.15 
2 143.213.200.137 
2 143.78.20.70 

2 147.198.123.172 
2 147.35.200.194 
2 147.35.213.91 

2 148.134.189.46 
2 150.113.76.139 
2 150.226.45.47 

2 152.11.116.194 
2 155.148.44,.143 
2 155.178.245.65 
2 155.178.254.112 
2 155.215.30.130 ° 
2 156.80.95.111 

2 158.4.146.65 

2 158.6.27.59 

2 160.147.161.122 
2 160.147.187.97 
2 160.149.102.114 
2 160.150.66.31 

2 167-154-251 .ipt.aol.com 
2 168.160.62.34 

2 192.136.133.243 
2 192.204.76.96 

2 194.205.134.148 
2 194.83.240.14 

2 195.216.149.60 
2 198.142.139.65 
2 198.250.192.202 
2 198.79.17.34 

2 199.10.233.125 
2 199.105.64.5 

2 199.209.78.3 

2 199.80.66.130 

2 1Cust244.tnt16.sfo3.da.uu.net 
2 200.0.188.111 

2 200.34.173.162 
2 201-178-96.ipt.aol.com 
2 202.103.154.241 
2 202.185.122.153 
2 202.186.77.1 

2 202.99.26.9 

2 203.231.163.40 


2 203.241.132.50 

2 203.244.105.160 

2 203.254.65.37 

2 204.148.120.12 

2 204.222.196.84 

2 204.80.228.11 

2 205.71.1.9 

2 206.104.11.70 

2 206.139.192.184 

2 206.214.72.228 

2 206.27.241.71 

2 207-172-118-144.8144.tnt13.brd.erols.com 
2 207-172-46-27.s27.tnt9.ann.erols.com 
2 207.100.238.67 

2 207.132.131.40 

2 207.212.242.113 

2 207.73.23.76 

2 208.148.75.2 

2 209.154.144.25 © 

2 209.26.148.100 

2 209.3.246.76 

2 209.46.194.142 

2 210.115.141.141 

2 210.79.227.105 

2 2Cust124.int8.krk1.da.uu.net 
2 2Cust14.tnt2.sdg1.da.uu.net 
2 33.19.109.223 

2 38.221.64.246 

2 38.233.185.228 

2 56.13.25.144 

2 55.36.254.125 

2 55.74.254.139 

2 550doac.irk.aetc.af.mil 

2 A22.waag.org 

2 AFOG151136.hq.af.mil 

2 AWC3-190.au.af.mil 

2 BLOSSEJM.appl.wpafb.af.mil 
2 DNS25.DFAS.MIL 

2 DarkForce9.hinesna.no 

2 F172044.scott.af.mil 

2 Hertzelia-204-125.access.net.il 
2 OTJAG-PCIP-245.army.pentagon.mil 
2 PBA-EMH1.ARMY.MIL 

2 PC-163180.Misawa.AF.MIL 
2 PC40739.MAC.CC.CMU.EDU 
2 Rdialup139.slkc.uswest.net 
2 WS3880-PA-2.acc.hill.af.mil 
2 ai21in75.lak.aetc.af.mil 

2 adeskout.autodesk.com 

2 ae1887.med.osd.mil 

2 aegis.bst.bellsouth.com 

2 airlift.ramstein.af.mil 


2 angrc.ang.af.mil 

2 as167.aselsan.com.tr 

2 asam&ra25.army.pentagon.mil 

2 aspen-fw-out.aspensys.com 

2 astfgl.stud.idb.hist.no 

2 aul-136-79.au.af.mil 

2 bess.triton.k12.wi.us 

2 bikf-5-hardops.keflavik.af.mil 

2 cache’ .unet.maine.edu 

2 6032919.navsea.navy.mil 

2 chslwl.spear.navy.mil 

2 cits-fw-1.mountainhome.af.mil 

2 cits-pr-2.seymourjohnson.af.mil 

2 cos165.bewell.net 

2 cpsg145079.kelly.af.mil 

2 crbgpc54.derb.dla.mil 

2 cs240-10.student.washington.edu 
2 dadovago1012.dada.it 

2 dasnhrochost-77.dasnhroc.navy.mil 
2 dfitzpat.campus.vt.edu 

2 dhcp40.mms.marshalltown.k12.ia.us 
2 dial-80.r04.garmhl.infoave.net 

2 dial-tif-1445.surfsouth.com 


2 dial10.kreative.net 
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2 dialup-125.melb.ozramp.com.au 
2 dns22.dfas.mil 

2 dogbert.cassiopeia.de 

2 drake.mildenhall.af.mil 

2 di173n7e.tampabay.rr.com 

2 dy4.com 

2 dyn-95-60-pontiac.netquest.com 
2 dyn19.cas1.chester.va.us.crosslink.net 
2 eagle.wes.army.mil 

2 eg-044-017.eglin.af.mil 

2 eg-077-239.eglin.af.mil 

2 ew.ew.edwards.af.mil 

2 frankenfurter.timewarp.co.uk 

2 frederik.pml.tno.nl 

2 fssec.army.mil 

2 fw.hq.pacom.mil 

2 gatekeeper.ray.com 

2 gauntlet-all.usiva.com 

2 gibson47.iswt.com . 

2 globalhq.submarinesystems.com 
2 grlu5115.cnet.navy.Mil 

2 groenmarkt-11.denhaag.dataweb.nl 
2 gw-dcx.uscouris.gov 

2 gw1.cat.com 

2 h0354.afpc.af.mil 

2 ha0782.ha.osd.mil 

2 host.159-142-161-53.gsa.gov 

2 host139.mga-advertising.co.uk 


2 host143.mga-advertising.co.uk 
2 host1741.acq.osd.mil 

2 hqda2-158.army.pentagon.mil 
2 ig084.4.dial.innovation.com 
2 illpc-5.pica.army.mil 

2 ilordfw.ang.af.mil 

2 ilpem2.brooks.af.mil 

2 inc-svr-proxy.incirlik.af.mil 

2 inet-gw.census.gov 

2 insinet4.nctamslant.navy.mil 
2 ip-26-169.phx.primenet.com 
2 ip-47-239.fhu.primenet.com 
2 ip522.pm1 1net.ips.techline.com 
2 isaiah.ner.disa.mil 

2 joellyn.aa.nps.navy.mil 

2 kure-pc10039.army.mil 

2 lfenster-pc.lib.ida.org 

2 lhoff.crrel.usace.army.mil 

2 Inpcgg.robins.af.mil 

2 Ir120116.littlerock.af.mil 

2 lua.lib.nps.navy.mil 

2 mars.mailgateway.net 

2 marse2-95.abo.wanadoo.fr 
2 mash4077.navsea.navy.mil 
2 max4ir.icx.net 

2 mb3-13a.dial-up.arnes.si 

2 mcn.walker.com 

2 mcproxye.mcclellan.af.mil 

2 micro2.schaub.ncsu.edu 

2 mine13.moel.valpo.edu 

2 mu.tulips.tsukuba.ac.jp 

2 nfmcc10.ncts.navy.mil 

2 nhchost-101.nhe.navy.mil 

2 node070e.a2000.nl 

2 nyfw.ang.af.mil 

2 obsidian.psistidell.com 

2 orp1.admn.siue.edu 

2 oso.nrl.navy.mil 

2 p146.amax28.dialup.ftw1 .flash.net 
2 p3-129.senate.gov 

2 palmerf.moon jic.com 

2 pc-085.wpc.af.mil 

2 pc33-462.sill.army.mil 

2 pcddih.pa.osd.mil 

2 pcdfoiw.pa.osd.mil 

2 pcdmf.pa.osd.mil 

2 pcfog.pa.osd.mil 

2 pcr103-2.ifn-magdeburg.de 
2 pdx-pm2-p10.coho.net 

2 pgpm3-1-67.olg.com 

2 piweba3y-ext.prodigy.com 
2 pm1-dbq112.dubuque.net 


2 pm3-134.clt.infi.net 

2 pm61-37.magicnet.net 

2 po.cs.utwente.nl 

2 pool-152-212.ptc.com 

2 pool002-max13.ds20-ca-us.dialup.earthlink.net 
2 pool015-max2.ds15-ca-us.dialup.earthlink.net 
2 pool024-max4.mpop2-ca-us.dialup.earthlink.net 
2 pool050-max12.ds24-ca-us.dialup.earthlink.net 
2 ppp-1-34.smf.visi.net 

2 ppp-asfm01--026.sirius.net 

2 ppp005.B.ite.net 

2 ppp0365-trnt.injersey.com 

2 ppp18-as5200.intranet.ca 

2 proxy-142.iap.bryant.webtv.net 
2 proxy.mcguire.af.mil 

2 proxy.signaal.nl 

2 proxy.spangdahlem.af.mil 

2 proxy1.hanscom.af.mil 

2 proxy2.grind1.tx.home.com 

2 proxy2a.lmco.com 

2 puck.pni.gov 

2 quixot.rug.ac.be 

2 randerso.ria.army.mil 

2 raptor.medialinx.ca 

2 ras18.vandenberg.af.mil 

2 relay.dia.osis.gov 

2 relay1.ucia.gov 

2 resnet89.unm.edu 

2 riangfw.ang.af.mil 

2 rocky.arnold.af.mil 

2 s13-pm10.snaustel.campus.mci.net 
2 8148.seacove.net 

2 sagere.pae.osd.mil 

2 scc003.tel.bnsf.com 

2 scorpion.usafa.af.mil 

2 sellers.gwillness.osd.mil 

2 shield1.schriever.af.mil 

2 shisa2.pref.okinawa.jp 

2 simone.chronicle.com 

2 slip129-37-216-80.co.us.ibm.net 
2 slip129-37-92-135.mi.us.ibm.net 
2 socks1.rochester.ibm.com 

2 spider-te081.proxy.aol.com 

2 spider-th074.proxy.aol.com 

2 spider-ti013.proxy.aol.com 

2 spider-ti023.proxy.aol.com 

2 spider-ti083.proxy.aol.com 

2 spider-tj033.proxy.aol.com 

2 spider-tk082.proxy.aol.com 

2 spider-tm044.proxy.aol.com 

2 spider-tn023.proxy.aol.com 

2 spider-tn064.proxy.aol.com 
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2 spider-to063.proxy.aol.com 
2 Spider-tp014.proxy.aol.com 
2 spider-wa034.proxy.aol.com 
2 spider-wa074.proxy.aol.com 
2 spider-wb052.proxy.aol.com 
2 spider-we064.proxy.aol.com 
2 spider-we073.proxy.aol.com 
2 spider-wg051.proxy.aol.com 
2 spider-wg064.proxy.aol.com 
2 spider-wj032.proxy.aol.com 
2 stubbyhqs.ncr.disa.mil 

2 syru208-119.syr.edu 

2 sys604.dtic.mil 

2 sys686.dtic.mil 

2 tcs-gateway3.treas.gov 

2 telseec.pr.osd.mil 

2 ti29a96-0168.dialup.online.no 
2 tmi-158.tmisystems.com 

2 tmo-gw1 .redstone.army.mil 
2 trac.army.mil 

2 trevetier.oro.doe.gov 

2 uly-tty2656.pld.com 

2 umbriel.inm.de 

2 unknown-15-120.rand.org 

2 user-38lcjr8.dialup.mindspring.com 
2 viking.delta-air.com 

2 whrg63.internetland.net 

2 whitleyr.pr.osd.mil 

2 ws090143.ramstein.af.mil 

2 ws110155.cnrf.nola.navy.mil 
2 ws138040.aviano.af.mil 

2 ws_221218.infortrend.com.tw 
2 wsc21 .Irz-muenchen.de 

2 ww-te04.proxy.aol.com 

2 ww-ti03.proxy.aol.com 

2 ww-tm02.proxy.aol.com 

2 ww-to03.proxy.aol.com 

2 ww-ip03.proxy.aol.com 

2 www-fw-proxy4.boeing.com 
2 www-proxy.tamedia.ch 

2 www.ubac.edu.mx 

2 xofu7.hq.af.mil 

1 1132-20.dinfos.osd.mil 
128.114.20.73 
128,220.151.37 
129.15.161.142 
129.207.100.237 
129.252.145.146 
129.4.95.100 

129.52.2.165 

129.52.2.66 

129.52.36.171 
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130.127.119.153 
130.212.201.143 
131.17.134.130 
131.32.124.118 
131.35.232.40 
131.40.120.11 
131.44.81.127 
131.45.19.210 
131.52.121.2 
131.55.51.231 
131.66.98.111 
131.7.77.129 
131.92.167.4 
132.15.118.64 
132.170.40.110 
132.80.10.143 
134.11.132.167 
134.131.161.172 
134.194.50.129 
134.240.51.90 
134.241.119.35 
136.205.43.72 
136.215.212.156 
136.215.238.137 
136.221.110.126 
137.240.138.32 
137.241.103.70 
137.244.168.181 
137.47.30.11 
138.180.16.97 
138.50.213.139 
138.64.82.88 
140.156.225.226 
143.134.165.51 
143.78.30.83 
143.83.144.62 
144.170.100.83 
144.195.45.193 
146.53.49.71 
147.153.249.30 
147.198.127.31 
147.240.108.236 
147.240.110.227 
149.228.146.11 
149.32.129.198 
150.113.102.108 
150.114.53.215 
150.226.80.165 
151.166.164.110 
151.los-angeles-04.ca.dial-access.ait.net 
152.163.205.68 
152.229.37.189 


155.148.47.217 
155.42.43.32 
155.43.64.188 
155.78.160.135 
155.82.242.103 
156.40.240.20 
156.80.119.100 
156.80.48.157 
158.103.214.200 
158.103.226.21 
158.111.242.56 
158.243.180.80 
165.107.2.120 
166.7.6.205 
168.150.253.197 
169.204.208.130 
171-114-154. ipt.aol.com 
173-109-53.ipt.aol.com 
173-22-30.ipt.aol.com 
192.107.87.34 
192.231.158.108 
193.129.5.80 
193.224.167.141 
193.56.37.25 
193.85.228.69 
194.126.42.74 
194.151.207.130 
194.254.231.42 
195.186.21.35 
195.20.81.35 

195.77.102.3 
195.77.36.178 
198.250.151.167 
198.76.92.150 
199.123.122.220 
199.212.167.3 
1Cust2.tnt5.krk1.da.uu.net 
1Cust206.tnt6.hou3.da.uu.net 
1Cust222.tnt2.redmond.wa.da.uu.net 
1Cust240.tnt9.bos2.da.uu.net 
1Cust250.tnt23.tco2.da.uu.net 
1Cust57.tnt5.dfw5.da.uu.net 
200.32.67.42 . 

202-41 .mcchord.af.mil 
202.225.21.7 
202.82.249.57 
203.17.162.9 
203.216.92.253 
203.216.99.193 
203.32.8.111 
203.59.52.130 

1 204.131.24.77 
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1 204.156.155.216 

204.208.136.151 

204.222.24.166 

204.44.134.153 

204.87.88.56 

205-208-138. ipt.aol.com 
205.214.163.118. 

205.215.198.39 

205.237.227.66 

205.253.98.62 

206.102.195.66 

206.135.198.130 

206.38.250.207 

206.39.34.25 

206.68.129.77 

206.80.138.139 

206.98.238.11 
207-172-147-25.s25.as1 .Ixp.erols.com 
207.106.118.70 

207.109.166.130 

207.203.40.6 

207.238.56.240 

207.28.236.183 

208.128.54.172 

208.156.29.34 

208.202.156.44 

208.210.235.1 

208.216.107.123 

208.216.107.124 

208.232.246.194 

209.195.7.50 

209.198.204.46 

209.27.70.227 

209.43.56.11 

209.7.192.243 
21.gate0.kadena.attnet.or.jp 
210.123.35.130 
232.morristown-05-1Ors.nj.dial-access.att.net 
2364-ENG-142.KOREA.ARMY.MIL 
32.100.29.19 
33m25c5a74.dscr.dla.mil 
35.los-angeles-20.ca.dial-access.att.net 
38.176.153.141 

38.186.184.2 

38.250.219.64 

4.12.134.32 

55.189.51.26 

55.71.249.63 

55.71.251.35 
55.new-york-15rs.ny.dial-access.att.net 
AMEDD172140.CS.AMEDD.ARMY.MIL 
ANAD-PROXY.ARMY.MIL 


= | S| i eS i a i i kek ee i a i i ek ka a kkk kk ek 
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Bluegrass.ang.af.mil 
CNNIB104-02.splitrock.net 
CS-CCQA-PUB.hickam.af.mil 
DET-39.TACCSF.KIRTLAND.AF.MIL 
DHCP37-133.MEDCOM.AMEDD.ARMY.MIL 
DNS23.DFAS.MIL 
DRCO007816.drce.com 
ESPISKURA.med.navy.mil 
G4BRACKETE95.forscom.army.mil 
G5-008.arcent.army.mil 
GATEKEEPER.TAMC.AMEDD.ARMY.MIL 
KEFTRO4.med.navy.mil 

LANGE. hqi.usme.mil 
LEMWSIMM1.med.navy.mil 
M076879.ns.nps.navy.mil 
MEKLEE.med.navy.mil 
PC-168188.misawa.af.mil 
PORTCULLIS.FC.DSWA.MIL 
PPP2.calarts.edu 
PRESTON502.vmi.edu 
RB525C.GOVERN.UIC.EDU 
SERVER-PROXY. hickam.af.mil 
SVWWW008.STL.MO.BOEING.COM 
WS-2300R2062-5.dm.af.mil 
a-go3-4.tin.it 

a-rm30-11.tin.it 
a076-122.crane.navy.mil 
abend.wwwcache.ja.net 

ag.frodo.org 
ahsd205-155-084-107.shasta-co.k12.ca.us 
aia118.aia.af.mil 
arapahoe.brooks.af.mil 
asd1716.wxs.nl 
athe530-b017.otenet.gr 
atl2-wc2.atlas.digex.net 
balden.dscr.dla.mil 

barkerj.hill.af.mil 

bcfw.ang.af.mil 
bess-proxy1.mdeca.ohio.gov 
bfce.tnoc.5sigcmd.army.mil 
bhager.nosc.mil 

bibph1 .hisingensvux.educ.goteborg.se 
brak.sys.sirrus.com 
broshear.aetc.af.mil 

brykj.pafb.af.mil 

cache-da01 .proxy.aol.com 
cache-db03.proxy.aol.com 
cache-dc04.proxy.aol.com 
cache-dd01.proxy.aol.com 
catgut.IInl.gov 

cdcegk1.agt.ab.ca 
chf-il5-77.ix.netcom.com 
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1 
1 
4 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
a | 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
4 
1 
1 
1 


chopper.nadepcp.navy.mil 
chuey.nawead.navy.mil 
cm0558h.jones.com 
emtn052p08.min.micron.net 
cnalfw.airlant.navy.mil 
cnspfw.cnsp.navy.mil 
co.hennepin.mn.us 
cobbler.weaver.guilford.k12.nc.us 
cpc81-acrs.hl.wku.edu 
cpsg156053.kelly.af.mil 
css186147.acccss.af.mil 
ctv21225131098.ctv.es 
d04.mdfrd.skyhigh.com 
dal25-02.ppp.iadfw.net 
danville-14.searnet.com 
dasnhrochost-178.dasnhroc.navy.mil 
desdoc109.monroe.army.mil 
dhcp-20-12.cecer.army.mil 
dhcp076105.sc.langley.af.mil 
dial-25.cent.co.yu 
dial08.icenet.com.au 
dial49.kreative.net 
dial9-40.tstar.net 
dialup33.tnt01 .livenet.net 
dialup46.onecom.com 
dns5.dfas:mil 

doc .bragg.army.mil 
does189063.scott.af.mil 
dogg2.dogg.com 
dynamic-195-209.hotwired.com 
egh-04052.eglin.af.mil 
ekahi18.hula.net 
electra.univ-savoie.fr 
errante.ext.u-paris 10.fr 
eugate.siemens.ch 
execpc.afcesa.af.mil 
famp14.uthscsa.edu 
farm561-23.worldpath.net 
finch-01.www-cache.demon.co.uk 
firewall. mmsuk.co.uk 
friedman3c954.secdef.osd.mil 
ftd-raa-fw.detrick.army.mil 
fip.senate.gov 
fw-02.microage.com 
fw-selfr.ang.af.mil 
gabrink.afis.osd.mil 

gate1 .bft.usmc.mil 
gate1.mcbbutler.usmc.mil 
gecko.ssec.wisc.edu 
gf235005067.dcmdw.dia.mil 
gk-east-3.usps.gov 
goalie.techmatics.com 
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1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 


gt16.eglin.af.mil 
gt7.eglin.af.mil 
gushost.gus.afres.af.mil 
gw.psns.navy.mil 
gw1.hughes-defense-comm.com 
gw32u.fmr.com 
h36.s95.ts.hinet.net 
ha0738.ha.osd.mil 
hd47-177.hil.compuserve.com 
hd74-021 .hil.compuserve.com 
hidest.state.de.us 
horseshoe.brooks.af.mil 


host-209-214-50-74.tys.bellsouth.net 


host1 1.everett.navy.mil 
htcmax13.netspace.or.jp 
http-gw2.croughton.af.mil 
htipbalt.northgrum.com 
iits01151.inlink.com 
iits01171.inlink.com 


inet-gateway.CO.Santa-Clara.CA.US 


intruder.naswi.navy.mil 
ip147.austin8.tx.pub-ip.psi.net 
ip185-254.konnections.com 
j83.bkj27 jaring.my 
ja-18wg-91 .kadena.af.mil 
jbrown.uis.itd.umich.edu 
jnCliB-82.ppp.justnet.ne.jp 
js-vax.robins.af.mil 
jseaba.ria.army.mil 
kyo023.ap.mind.ne.jp 
kyo082.ap.mind.ne.jp 
lagrange.ntsv2.usric81.esn.net 
leav-173-21 army.mil 
Igtr-4b344-7.hq.af.mil 
linux.stk.com 
1k167043.robins.af.mil 
johs20.integris-health.com 
ir43762.littlerock.af.mil 
lyster131 .brooks.af.mil 
mail.clingendael.nl 
matai.nor.fisc.navy.mil 
md38-154.mun.compuserve.com 
mdu_d1.chn.vsnl.net.in 
mercury.singnet.com.sg 
mex28-200.uninet.net.mx 
min-mn17-12.ix.netcom.com 
mnemonic.grn.es 
mongo.sdccd.cc.ca.us 
msagate.msanet.com 
mspni02.msp.afres.af.mil 
net144-187.mclink.it 
net3-cust121.cos.wantweb.net 
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1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 


ns‘ .littondsd.com 

ns2.ITB.ac.id 

ns2.dlj.com 

ns2.jntf.osd.mil 
ns2.nadepni.navy.mil 

or.bIm.gov 

08f8133054331 .ncr.disa.mil 
0u30-56.dsdc.dla.mil 
p157.sas5.dialup.san1 .flash.net 
p170.amax14.dialup.hou .flash.net 
p204.sas15.dialup.lax1 .flash.net 
pallas.shoshin.co.jp 
palo2.pacific.net.sg 
panorama.nus.edu.sg 
papat.barksdale.af.mil 
pe-ce14.afit.af.mil 
pc-fv5772.plk.af.mil 
pc56.net40.vicenza.army.mil 
pc6.ameriserve.com 
pcdpcg.pa.osd.mil 
pcdpla.pa.osd.mil 
pm-nb6-207.coastalnet.com 
pm15-181.orf.infi.net 
pm2-s16.dial-up.abs.net 
pm4-30.kconline.com 
pool015-max3.ontario-ca-us.dialup.earthlink.net 
pool044-max2.sb-ca-us.dialup.earthlink.net 
port31.pens.prodigy.net 
poste88-17.csdd.fse.ulaval.ca 
powerhd.tec.army.mil 
ppp-207-214-212-71.snic01 .pacbell.net 
ppp0556 jax.gibralter.net 
ppp6.na.cybernet.it 
ppp61.logan.hockinghills.net 
proxy-173.iap.bryant.webtv.net 
proxy-out.apanet.at 
proxy-ta.netvision.net.il 
proxye1-atm.tampabay.rr.com 
proxye2-atm.tampabay.rr.com 
proxye4-atm.tampabay.rr.com 
proxywest.northgrum.com 
redgate.kcc.com 
rtscom5068.state.fl.us 
sc0711308.ess.harris.com 
sc039ws219.nosc.mil 
scifw.sci.com 
sdn-ar-O002nybuffP313.dialsprint.net 
sentry.soc.mil 
shafter-200pc143.army.mil 
shepherd.hurlburt.af.mil 
slb-proxy-01.boeing.com 
sm9698.mcclellan.af.mil 


sm9768.mcclellan.af.mil 
smcem5.comm.hq.af.mil 
snd-fw.med.navy.mil 
spider-pa073.proxy.aol.com 
spider-te074.proxy.aol.com 
spider-tf022.proxy.aol.com 
spider-tf054.proxy.aol.com 
spider-tf061 .proxy.aol.com 
spider-th031.proxy.aol.com 
spider-th073.proxy.aol.com 
spider-ti042.proxy.aol.com 
spider-tj024.proxy.aol.com 
spider-{j034.proxy.aol.com 
spider-tj052.proxy.aol.com 
spider-tk011.proxy.aol.com 
spider-tk013.proxy.aol.com 
spider-tk044.proxy.aol.com 
spider-tl084.proxy.aol.com 
spider-tm023.proxy.aol.com 
spider-tm073.proxy.aol.com 
spider-tn014.proxy.aol.com 
spider-to023.proxy.aol.com 
spider-to061.proxy.aol.com 
spider-to062.proxy.aol.com 
spider-tp013.proxy.aol.com 
spider-tp052.proxy.aol.com 
spider-tq053.proxy.aol.com 
spider-tq064.proxy.aol.com 
spider-tq071.proxy.aol.com 
spider-iq082.proxy.aol.com 
spider-tq083.proxy.aol.com 
spider-tr083.proxy.aol.com 
spider-wa021.proxy.aol.com 
spider-wa031 .proxy.aol.com 

’ spider-wb071.proxy.aol.com 
spider-wc062.proxy.aol.com 
spider-wc083.proxy.aol.com 
spider-wd034.proxy.aol.com 
spider-wd084.proxy.aol.com 
spider-wj074.proxy.aol.com 
ssherman.tinker.af.mil 
staff-ritterband.jrn.columbia.edu 
steiner.ingsud.dga.fr 
styx-e76.bruyeres.cea.fr 
syr-gw.ang.af.mil 
sys165.dtic.mil 
sys180.dtic.mil 
sys769.dtic.mil 
system83-88.losangeles.af.mil 
szint02.whiteman.af.mil 
tba13-31 .tba.com.br 

1 tc0004-25.softcom.net 
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1 ti34a22-0086.dialup.online.no 
1 tnt130.wcc.net 

1 tres.vandenberg.af.mil 

1 ‘ts7-40.she.cyberhighway.net 
tswpb1-51.gate.net 
uc180162.eucom.mil 
unix.mboard.com 

unix1 .marian.pvt.k12.mi.us 
user.milchev.com 
usr1-53.pns.infi.net 
vera.dyess.af.mil 

1 warhul3_3438.dynamic.macdill.af.mil 
1 wessc058114.scott.af.mil 

1 wd3-de.wisedial.wilmington.net 
1 webgate0.mot.com 

1 whmpc.usgmrl.ksu.edu 

1 ws132184.cnrf.nola.navy.mil 
1 ws23.darpa.mil 

1 ws40.lex2.k12.sc.us 

1 wt-d6-9.wt.net 

1 ww-pa01.proxy.aol.com 

1 ww-pa03.proxy.aol.com 

1 ww-ta02.proxy.aol.com 

1 ww-ta03.proxy.aol.com 

1 ww-te02.proxy.aol.com 

1 ww-ti04 proxy.aol.com 

1 ww-tj02.proxy.aol.com 

1 ww-tj04.proxy.aol.com 

1 ww-tk03.proxy.aol.com 

1 ww-tl02.proxy.aol.com 

1 ww-tl04.proxy.aol.com 

1 wv-tn01.proxy.aol.com 

1 ww-tn02.proxy.aol.com 

1 ww-tn03.proxy.aol.com 

1 ww-tp04.proxy.aol.com 

1 wwproxy2.wonderware.com 
1 www-tfw-proxy2.boeing.com 
1 www-relay3.pa-x.dec.com 

1 wwwjwid.pacom.mil 

1 24862.afpc.af.mil 

1 28530.afpc.af.mil 

1 zama-46pc33.army.mil 

1 zama236.poj.usace.army.mil 
1 zanzo.energy.it 

1 zzcelsiu.dialin.ug.net.au 
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95 proxy1.etntwn1.nj.home.com 
90 Atv.CODEC.Ro 

87 proxy2.etntwn1.nj.home.com 
87 x1-6-00-a0-24-cc-73-73.bc.edu 
‘63 proxy2.iol.it 

56 face.vbs.at 

48 sc340b.gc.osd.mil 

41 195.31.198.226 

40 K-14.DAS.McGill.CA 

38 igate.bruderhof.com 

37 d2-s8-102-telehouse.mistral.co.uk 
36 cits-pr-2.seymourjohnson.af.mil 
35 bellbird.qut.edu.au 

32 24.88.7.53 

31 pix79147.simko.com.tr 

29 ppp-sfx201--232.sirius.net 

28 evil.aec.at 

28 m158.inf.unizar.es 

28 wallander.hsb.se 

24 160.149.192.50 

23 1Cust114.tnt1 .princess-anne.va.da.uu.net 
23 dd62-173.dub.compuserve.com 
20 192.106.173.21 

20 bubba.idshq.com 

20 deptvass2-bh.va.gov 

19 ip63.pm2net.ips.techline.com 
19 keenan.apollo-ent.com 

19 luey.nawcad.navy.mil 

19 proxyhard.idirect.com 

18 209.112.45.10 

18 newclinusr2-a66.indy.tds.net 
17 proxy-gw.fs.Imco.com 

17 saturn.mch.sni.de 

17 sys01.spawar.navy.mil 

16 147.217.58.252 

16 gateway.broward.k12.fl.us 

16 morph.ripco.com 

16 proxy5.cityweb.de 

16 twt-my.nasionet.net 

15 140.156.95.145 

15 DIAL6-ASYNC07.DIAL.NET.NYU.EDU 
15 customs.proxy.Jucent.com 

15 intgate1.hessen.de 

14 150.113.53.139 

14 host.stratcom.af.mil 

14 userm393.uk.uudial.com 

13 ip97.portland3.or.pub-ip.psi.net 
13 pc32-67.afsac.wpatb.af.mil 

13 pec-155.au2.k.uunet.de 

13 ppp05-19.ght.iadfw.net 

12 SVWWW007.STL.MO.BOEING.COM 
12 cable1-231.gte.net 
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12 portal2.west.saic.com 
11 155.9.33.217 
11 202.54.79.225 
11 205.237.87.72 
11 maryann143.cos.pcisys.net 
11 wisharp.campus.vt.edu 
11 ztm51-21.Zoetermeer.NL.net 
10 136.141.2.12 
10 158.240.47.124 
10 160.150.60.51 
10 195.74.225.58 
10 207-172-109-97.s34.as2.war.erols.com 
10 32.100.113.38 
10 RAS5-p43.hfa.netvision.net.il 
10 c208-219-145-115.kivex.com 
10 d107-233.library.usna.edu 
10 user-38Ic75q.dialup.mindspring.com 
9 150.226.56.115 
9 160.147.164.151 
9 195.74.225.62 
9 202.130.229.170 
9 dodig.osd.mil 
9 krusty.keesler.af.mil 
9 p2-156.senate.gov 
9 proxy2.hanscom.af.mil 
9 safi68183.hq.af.mil 
9 sc332a.gc.osd.mil 
9 usm-0045-164.wans.net 
9 venere.progel.it 
8 128.198.48.72 
8 129.71.93.76 
8 accord.scott.disa.mil 
8 adm-1045-6.fac.unbc.ca 
8 adnline244-243.adnc.com 
8 amembpol1.demon.co.uk 
8 as1-52.ncle.hunterlink.net.au 
8 kiiga-gu-57k.gu.kiev.ua 
8 net144-049.mclink.it 
8 pawg.ang.af.mil 
8 pec-13.au4.hh.uunet.de 
8 pn967388.lanl.gov 
8 proxy1.tayloru.edu 
8 sdn-ar-004mnminnP276.dialsprint.net 
8 wpmsc01 .wpafb.af.mil 
8 wws-9vb6l.Princeton.EDU 
8 www-fw-proxy3.boeing.com 
7 136.205.133.242 
7 170.141.171.43 
7 206.64.142.222 
7 dialup122.lemoorenet.com 
7 p144.suwon1.shinbiro.com 
7 proxy.kolb.net 
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7 spider-wb083.proxy.aol.com 
6 12.8.224.139 

6 140.140.5.224 

6 143.231.131.20 

6 206.5.146.95 

6 208.226.7.221 

6 26.129. internal.radian.com 
6 a-bo16-14.tin. it 

6 almgm187.ang.af.mil 

6 coil.nosc.mil 

6 host-11-63.projo.com 

6 p413-025.ppp.get2net.dk 
6 pat.manpower.usme.mil 

6 proxy.spangdahlem.af.mil 
6 sun-1-s03.stewart.army.mil 
6 umbriel.inm.de 

5 129.29.151.21 

5 157.204.240.87 

5 1Cust252.tnt2.atl2.da.uu.net 
5 206.54.77.147 

5 209.176.133.250 

5 Portal.East.saic.com 

5 chuey.nawcad.navy.mil 

5 d40.pm15.sonic.net 

5 floatpc8.isx.com 

5 gonzalae2821278.dynamic.macdill.af.mil 
5 houston.netexplorer.com 
5 pcian.unicef.org 

5 proxy-hq.dcaa.mil 

5 uc168157.eucom.mil 

5 webgate0.mot.com 

5 ws096053.ramstein.af.mil 
5 ww-ti02.proxy.aol.com 

5 ww-ti04.proxy.aol.com 

5 www-fw-proxy5.boeing.com 
5 xar.ethz.ch 

4 131.137.109.137 

4 131.79.150.187 

4 136.205.218.178 

4 136.219.110.165 

4 137.245.78.54 

4 140.139.27.15 

4 142.204.39.48 

4 144.18.103.54 

4 148.8.11.98 

4 158.5.39.35 

4 193.92.17.69 

4 202.38.153.163 

4 204.49,35.83 

4 DIAL3-ASYNC21.DIAL.NET.NYU.EDU 
4 SCM2.goodfellow.af.mil 

4 ase17.wpafb.af.mil 
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4 blackhawk.atsc-dsc.com 

4 corpuschristi-9.navtap.navy:mil 
4 gate1.cpp.usmce.mil 

4 gateway.dr.dk 

4 hays-nelson.com 

4 honeypie.beehive.de 

4 ins042428.ner.disa.mil 

4 jags.jax.fisc.navy.mil 

4 k1 fujitsu.co.jp 

4 k2.fujitsu.co.jp 

4 k3.fujitsu.co.jp 

4 Idavis.vpb.GaSoU.edu 

4 leav-167-61 army.mil 

4 ligarius-fe0.ultra.net 

4 mex31-163.uninet.net.mx 

4 paschal.gradient.ie 

4 pequin.eecom.gatech.edu 

4 pppr02-141 .big.or.jp 

4 shepherd. hurlburt.af.mil 

4 snd-fw.med.navy.mil 

4 spider-ti043.proxy.aol.com 
4 ws056119.ramstein.af.mil 

3 005608.onr.navy.mil 

3 08.gate2.kadena.attnet.or.jp 
3 129.new-york-12.ny.dial-access.att.net 
3 131.120.145.155 

3 131.32.130.132 

3 131.32.153.161 

3 131.7.82.112 

3 134.11.125.103 

3 138.164.144.223 

3 147.240.76.186 

3 158.11.66.116 

3 160.149.107.107 

3 164.66.63.210 

3 195.99.129.165 

3 198.76.92.150 

3 199.122.32.175 

3 199.123.122.209 

3 1Cust25.tnt2.den2.da.uu.net 
3 202.48.105.36 

3 204.146.76.71 

3 207.133.203.109 

3 207.50.175.79 

3 208.152.243.22 

3 55.74,250.72 

3 BURNS.NAVSSES.NAVY.MIL 
3 CITS-PROXY.moody.af.mil 
3 DHCP175-194.LRMC.AMEDD.ARMY.MIL 
3 TSIBLEY2.HCSSA.AMEDD.ARMY.MIL 
3 WS-4850-RM15-1.dm.af.mil 
3 afncc-s010.Its.aetc.af.mil 
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3 b795rm5_3.mcconnell.af.mil 
3 bornfree.proxy.lucent.com 

3 buklum.simko.com.tr 

3 cache1.unet.maine.edu 

3 drake.mildenhall.af.mil 

3 eg-227-076.eglin.af.mil 

3 firewall.scoit.af.mil 

3 fw02-1.lerc.nasa.gov 

3 fw240.smed.net 

3 gate1.mcbbutler.usmc.mil 

3 gatekeeper.ray.com 

3 gatekeeper02.stricom.army.mil 
3 gfoxhall.camp.org 

3 hqda224-142.army.pentagon.mil 
3 hqdla_proxy01.hq.dla.mil 

3 inhuf-fw.ang.af.mil 

3 iwdc2.it-protect.com 

3 jupiter.ingalls.com 

3 k7.fujitsu.co.jp 

3 k8.fujitsu.co.jp 

3 kadena-195.kadena.af.mil 

3 lager.sel.sony.com 

3 leav-63-166.army.mil 

3 longtan.library.uwa.edu.au 

3 mbeane.crrel.usace.army.mil 
3 ms01223.ppp.infoweb.or.jp 
3 n101client164.hawaii.rr.com 
3 neang.ang.af.mil 

3 ns1.dlj.com 

3 onet2.cup.hp.com 

3 pc0088.dpsc.dla.mil 

3 pc207-148.lewis.army.mil 

3 pcddiy.pa.osd.mil 

3 pci-storm2.netpci.com ’ 
3 pm3-21.ppp58.webzone.net 
3 pm3-21.ppp81.webzone.net 
3 pntn041692.ncr.disa.mil 

3 ppp-206-170-2-234.sntc01.pacbell.net 
3 ppp1-34.nadn.navy.mil 

3 ppp26.vib.tele.dk 

3 pppschi16.bunt.com 

3 relay.atinc.com 

3 set.malmstrom.af.mil 

3 shadow.dra.hmg.gb 

3 shield1.schriever.af.mil 

3 shiva_isp108.nctsw.navy.mil 
3 sklugger.ria.army.mil 

3 snowwhite.GrandForks.af.mil 
3 spider-tk012.proxy.aol.com 
3 spider-tl083.proxy.aol.com 

3 spider-tm032.proxy.aol.com 
3 steuben.external.lmco.com 


3 tdixon.mis.semi.harris.com 
3 ucdps00.js.pentagon.mil 

3 uodlanfw.army.pentagon.mil 
3 user-38lcit4.dialup.mindspring.com 
3 user138175.do.langley.af.mil 
3 user247.ra.osd.mil 

3 veggen.vg.no 

3 woody.dyess.af.mil 

3 ws024119.sanvito.af.mil 

3 ws241037.ramstein.af.mil 
2 131.247.118.201 

2 131.52.121.2 

2 131.92.166.147 

2 132.159.91.241 

2 132.159.99.251 

2 132.30.147.47 

2 132.60.206.40 

2 139.161.193.49 

2 140.187.105.184 

2 143.77.47.133 

2 143.77.69.230 

2 144.59.245.163 

2 147.240.126.85 

2 155.147.103.35 

2 155.218.177.113 

2 155.75.37.148 

2 158.243.8.22 

2 158.5.18.160 

2 159.140.244.114 

2 160.146.1.209 

2 164.221 .226.39 

2 165.134.21.44 

2 168.69.165.13 

2 193.216.120.131 

2 193.56.37.25 

2 195.126.115.145 

2 195.200.66.89 

2 198.146.58.230 

2 198.202.177.127 

2 198.253.157.42 

2 1Cust182.tnt11.krk1.da.uu.net 
2 1Cust240.tnt1 .santa-monica.ca.da.uu.net 
2 202.54.31.218 

2 205.233.30.131 

2 205.252.240.12 

2 208.136.198.244 

2 208.158.182.168 

2 209.88.198.65 

2 210.225.16.236 

2 38.251.200.75 

2 55.45.254.191 

2 55.70.247.35 


2 A0024171.dscc.dla.mil 

2 ILEDHCP43246.hq.af.mil 

2 JADE.BXA.DOC.GOV 

2 KERNSML.ws.afrl.af.mil 

2 SA5399-6-16.stic.net 

2 WA906.pafb.af.mil 

2 airtpol.afis.osd.mil 

2 area342.pae.osd.mil 

2 beproxy1.ac.il 

2 bice.tnoc.5sigemd.army.mil 
2 bluebird.qut.edu.au 

2 buffalo.rmplc.co.uk 

2 cache.esinet.ee 

2 cits-fw-1-ext.pope.af.mil 

2 cooper51.labs.clemson.edu 
2 coopers-fwd.us.coopers.com 
2 cpu2521.adsI.bellglobal.com. 
2 crbgpce54.derb.dla.mil 

2 crus6.pica.army.mil 

2 d-ma-superpop-178.ici.net 

2 d495.pppdel.vsni.net.in 

2 dial159.rad-pm3.bluegrass.net 
2 dip071.wesnet.com 

2 dns24.dfas.mil 

2 dutlobb.Ir.tudelft.nl 

2 edas.edas.co.kr 

2 fairfax.icfkaiser.com 

2 figaro.ele.ita.cta.br 

2 firewall.dmea.osd.mil 

2 fwigka.admin.ch 

2 gate1.bam.usmc.mil 

2 gate1.quantico.usmc.mil 

2 gw.psns.navy.mil 

2 gw.sdbghs.dk 

2 hatch.udip.com 

2 hd48-223.hil.compuserve.com 
2 hholm.smart.net 

2 inc-svr-proxy.incirlik.af.mil 

2 internet.walgreens.com 

2 i0c201.aia.af.mil 


2 ip97.pascagoula2.ms.pub-ip.psi.net 


2 jc131-90.ddc.dla.mil 

2 k4.fujitsu.co.jp 

2 lak-proxy-1 .lakenheath.af.mil 
2 leav-102-101.army.mil 

2 leav-33-6-151.army.mil 

2 Ima125.aflma.gunter.af.mil 

2 mabaf.ang.af.mil 

2 max9-18.hk.super.net 

2 medgrp072102.scott.af.mil 

2 mercury.sovam.com ° 

2 mg-20664220-97.ricochet.net 
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2 mgtechinc01.erols.com 

2 mitretek.org 

2 mx1.spectristech.com : 

2 n451c.sin.mrms.navy.mil 

2 ostm69.awacs.af.mil 

2 p3-224,senate.gov 

2 pacfa.fleet.navy.mil 

2 pc30-7.afsac.wpafb.af.mil 

2 pcdfoiw.pa.osd.mil 

2 penu1271.cnet.navy.Mil 

2 penu3466.cnet.navy.Mil 

2 ppp0038 jax.gibralter.net 

2 ppp10-59.hstntx.onramp.net 

2 ppp12805.on.bellglobal.com 

2 ppp131.minot.com 

2 ppp9141.po.iijnet.or.jp 

2 proxy-225.iap.bryant.webtv.net 

2 proxy.toyo-eng.co.jp 

2 proxy1b.Imco.com 

2 raven.ang.af.mil 

2 seh-fw.sembach.af.mil 

2 shq-ot-529.nosc.mil 

2 slip166-72-189-219.me.us.ibm.net 

2 spfwall.ssp.navy.mil 

2 spider-te063.proxy.aol.com 

2 spider-tf024.proxy.aol.com 

2 spider-to013.proxy.aol.com 

2 spider-wb063.proxy.aol.com 

2 stadw78.Colorado.EDU 

2 system145-72.losangeles.af.mil 

2 tdi118.netcnct.net 

2 tnpolla.afis.osd.mil 

2 txnbe-fw.ang.af.mil 

2 usamraa-nt021 .detrick.army.mil 

2 usarc-fw.army.mil 

2 user152171.do.langley.af.mil 

2 weald2.air.saab.se 

2 wvmrb-fw.ang.af.mil 

2 ww-ti01 .proxy.aol.com 

2 www-fw-proxy1.boeing.com 

2 yellow.javanet.com 
102. ft-lauderdale-01 .fl.dial-access. att.net 
12.8.224.141 
128.163.171.69 
129.200.62.6 
129.52.51.45 
131.120.41.126 
131.137.255.6 
131.24,.202.227 
131.32.139.33 

—131.55.202.28 
131.61.122.118 


= 
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131.92.130.168 
132.159.83.29 
134.152.115.200 
134.152.76.36 
136.205.236.151 
136.215.192.158 
136.220.200.116 
137.240.48.253 
137.242.97.116 
138.164.211.73 
139.139.219.47 
140.155.214.15 
140.156.225.226 
140.156.93.65 
140.183.10.148 
140.76.238.7 
141.165.51.231 
142.207.33.158 
144.103.3.67 
144.170.216.71 
147.133.5.203 
147.160.9.58 
147.238.107.19 
147.39.29.135 
151.166.42.161 
152.163.204.46 
152.75.114.12 
155.217.35.96 
157.182.128.164 
158.11.163.107 
158.11.66.114 
158.4.127.78 
158.5.25.172 
160.10.79.219 
160.135.43.12 
160.147.35.220 
160.148.10.107 
160.151 .88.60 
160.209.9.5 
164.124.250.74 
164.156.107.130 
164.87.205.178 
165.88.94.59 
166.37.65.153, 
171-153-114.ipt.aol.com 
174-225-110.ipt.aol.com 
192.136.133.92 
193.186.185.3 
193.188.93.5 
193.230.240.22 
193.29.77.101 
194.92.239.134 


0910sort 


195.103.95.162 
195.163.2.34 
195.174.79.147 
195.184.228.102 
195.20.81.11 

195.3.98.15 
198.109.221.185 
198.168.189.134 
198.76.88.70 
198.79.17.34 
198.83.178.3 

198.98.83.71 
499.123.122.100 
199.123.92.84 
199.211.122.35 
199.242.131.147 
199.98.183.207 
1Cust131.tnti.den2.da.uu.net 
1Cust189.tnt1 harrisburg.pa.da.uu.net 
200.210.166.156 
200.38.1.91 
202.158.3.200 

1 202.185.193.36 
202,.82.192.85 
202.96.33.58 
202.99.41.73 
202.99.41.97 
203.172.7.174 

1 203.230.216.101 
204.32.2.149 
205.128.202.70 
206-31-165-55.inil.com 
206.129.139.94 
206.133.127.206 
206.155.167.4 
206.arlington-01.va.dial-access.att.net 
207-172-233-86.s23.as2.wmn.erols.com 
207.203.40.6 
207.240.119.162 
207.240.93.145 
207.90.80.2 
208.222.108.250 
208.228.40.101 
209-63-247-30.smf.jps.net 
210.113.2.2 
23.los-angeles-16.ca.dial-access.att.net 
38.179.192.165 
5069ubi.popsite.net 
55.192.2.236 

55.45.5.214 

55.71.238.65 

97ja177161 |ts.aetc.af.mil 
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1 A310B.carlisle.army.mil 
CITS-FW-1.bolling.af.mil 
Elvis.nellis.af.mi 
FOS2-4.marinemwr.or.jp 
GATEKEEPER. TAMC.AMEDD.ARMY.MIL 
HSTNB204-20.splitrock.net 
JRA140.rh.psu.edu 
LINDA.acclog.af.mil 
MDNTDL17.SLAC.Stanford.EDU 
OCEANA-OCC1.med.navy.mil 
OshkoshSD-5.nat.wiscnet.net 
RAYEMM.forscom.army.mil 
SERVER-PROXY. hickam.af.mil 
YF58020AO0P63.asc-yf.wpafb.af.mil 
acsim-130.army.pentagon.mil 
angrc.ang.af.mil 
b1025pc18.spd.aetc.af.mil 
bell-33.aaa.army.mil 
bess-proxy1.macomb.k12.mi.us 
brk-23-78.tm.net.my 
brownd.whiteman.af.mil 
cache-da01.proxy.aol.com 
cache-da03.proxy.aol.com 
cache-da06.proxy.aol.com 
cache-db03.proxy.aol.com 
cache-db04.proxy.aol.com 
cache-dc02.proxy.aol.com 
cache-out.saix.net 
cag-5-202.robins.af.mil 
ce-160-71.au.af.mil 
centaf-17-223.centaf.af.mil 
cits-fw-1 .mountainhome.af.mil 
client-151-197-1 17-69. bellatlantic.net 
cpsg145079.kelly.af.mil 
cus4818.brooks.af.mil 
darkside.nmic.navy.mil 
di-gw.disclosure.com 
dialup208-3-1.swipnet.se 
dns.rfa.org 

dns22.dfas.mil 
donhqns§.hq.navy.mil 
dyn-v14.advicom.net 
dyn0049.minot.ndschooinet.k12.nd.us 
eg-228-009.eglin.af.mil 

1 fire.ittnj.com 

1 firewall.omv.co.at 

1 firewall5.lexis-nexis.com 

1 flower.seistl.com 

1 fw-selfr.ang.af.mil 

1 fw-tu04.HAC.COM 

1 gatekeeper3.sni.co.uk 

1 gateway. healthlink.on.ca 
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1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
1 
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gateway .caribe.net 
gw235063152.dcmdw.dla.mil 
harry.cilea.it 
hercules.sicily.navy.mil 
hil-dnppo-052.oh.compuserve.net 
hornbake-335.umd.edu 
host-209-214-177-56.ags.bellsouth.net 
hqda3-006.army.pentagon.mil 
ics2F.BN.srv.t-online.de 
ie-bry-prox-nt1 .bray.ie.dell.com 
ihigw.ihi.co.jp 

ilpia-fw.ang.af.mil 

imitchel jriver.com 
ip2.kissimmee.org 
ip230.huntsville.al.pub-ip.psi.net 
jayhawk.vance.af.mil 
jumpgate.nadjx.navy.mil 
kahan.rl.plh.af.mil 
kneecer.pae.osd.mil 
kop-ts1-157.p3.net 
kure-pc10039.army.mil 
lab7.phys.pusan.ac.kr 
launtma1f01 .lautechnologies.com 
lisas8-p59.telepac. pt 
lon-7021-a285.long-beach.va.gov 
mail.exchange.de 
mtracy.alhrg.wpafb.af.mil 
ns1.menwith.army.mil 
opce120.out. TRW.COM 
oproxy.collins.rockwell.com 
p4-max19.akl.ihug.co.nz 
palisade.spacecom.af.mil 
pma33.burgoyne.com 
podl-207-205-203-128.kgpr.grid.net 
port56.annex4.radix.net 
ppp-207-193-14-40.hsintx.swbell.net 
ppp-mar120.ath.forthnet.gr 
ppp150.ezl.com 
proxy-114.iap.bryant.webtv.net 
proxy-115.iap.bryant.webtv.net 
proxy-173.iap.bryant.webtv.net 
proxy-212.iap.bryant.webtv.net 
proxy.abnamro.nl 

proxy.coqui.net 
proxy1.hanscom.af.mil 
proxy2.swisscom.com 
putnums.tulips.tsukuba.ac.jp 
redwolf.ci.lincoln.ne.us 
relay.nima.mil 

risc.shedv.de 
rjo-wg03.unikey.com.br 
rpbarret-a5873.apgea.army.mil 


80060081 25140.tinker.af.mil 
$244182.microweb.net 
saf16950.hq.af.mil 
sc169-fw.ang.af.mil 
sh30155.shaw.af.mil 
shager.telos.com 
skidmorej.hq.af.mil 


spider-tf064.proxy.aol.com 
spider-tj072.proxy.aol.com 
spider-tj074.proxy.aol.com 
spider-t}081.proxy.aol.com 
spider-tk054.proxy.aol.com 
spider-tk063.proxy.aol.com 
spider-tl053.proxy.aol.com 
spider-tm024.proxy.aol.com 
spider-tp033.proxy.aol.com 
squid.rage.com.au 


svm-ts3-17.c2i2.com 
system131.tyndall.af.mil 
tc1.bora.net 
tild79.kelly.af.mil 
trac.army.mil 
transport.modot.state.mo.us 
uci180027.eucom.mil 
unix5.planete.net 
unvgate.aabc.dk 
upsi138.151.und.NoDak.edu 


userm302.uk.uudial.com 
wall3.dss.mil 

1 waska-fw.ang.af.mil 

1 wbpxy01.ne.mediaone.net 
1 wdominic.okc.disa.mil 

1 ws084053.gordon.army.mil 
1 ws167124.rheinmain.af.mil 
1 ws218228.cnrf.nola.navy.mil 
1 ws4-210.edwards.af.mil 

1 ww-tm02.proxy.aol.com 

1 ww-ip04.proxy.aol.com 

1 www-fw-proxy2.boeing.com 
1 wwwerat.wellsfargo.com 

1 xord17.hq.af.mil 
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slip-32-100-242-35.wv.us.ibm.net 


staff-ritterband.jrn.columbia.edu 
stl-proxy-01.STL.MO.BOEING.COM 


user-38lcitt.dialup.mindspring.com 
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DATE l2-28-2015 By Cagwaseal usicc @ : ‘ ©} 


(12/31/1995) 
FEDERAL EUVREAU OF INVESTIGATION 
\ \- | g- g ¢ 


Precedence: PRIORITY Date: 10/15/1998 
York ‘| Attn: SSA 
A ashington Field Attn: SSA 
SA 
4, 


From: National Securit 
NIPC/CIU/Room b6 
Contact: SSA b7¢c 
Spproves *Y fs | f | 
Ney 
ae Coos 


Case ID #: 288-WF-NEW. +Pendine? 
288-HQ-1234199 


Title: UNKNOWN SUBJECT(S), AKA 
ELECTRONIC DISTURBANCE THEATER (EDT) 
DEPARTMENT OF DEFENSE (DOD) 
CITA - Denial of Service/Intrusion 


Synopsis: WFO is requested to obtain opinions from the Eastern 
District of Virginia (EDVA) concerning both the Electronic 
Disturbance Theater (EDT) actions and the Department of Defense 


(DoD) actions in this matter. 
b6 


Administrative: Re conversation with sats 10/8/98; b7c 
and ssa [_] 10/9/98. 


Enclosure(s): For New York and WFO are the following is one 
package of various materials providing background on the EDT and 
their protest. 


Details: The Electronic Disturbance Theater (EDT) is apparently 
a group of about five activists which has primarily targeted 
Mexican and U.S. Government computer sites in support of Mexico's 
Zapatista National Liberation Army. The EDT promotes a tactical 
device called "FloodNet," designed to disrupt access to targeted 
web sites by flooding the host server with requests for that web 
page. The EDT's claims and agenda have been posted on a web site 


located at New York University. 
ABW aegeer- & 


In September the EDT targeted the Mexican President' 
page, the Pentagon in the U.S., and the Frankfu 
in Germany. The EDT bulletin board advised tha HC) reich soy cy. 
of the actions were minimal due to countermeasures which blocked 


NOY 2 3 1998 
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To: New York From: National Security e 
Re: 288-WF-NEW, 10/15/1998 


the action, and which caused the participant's hard drives to 
crash. The Pentagon confirmed the use of effective 
countermeasures, with no damage to their system. 


The subject matter resulted in no known damage to U.S. 
systems, no impact status was received from overseas, and no 
overseas complaint was received. 


ion from an article in Defense News indicates 
f the EDT individuals involved in the 


that 
action. 


b6 
b7C 


in the article talks about the EDT actions, and that 
he is not worried about the legality of the actions as he was not 
involved in anything illegal. He also advised that New York 
University informed him that he must remove the EDT web site from 
the university network. 


The article indicates the participants used a computer 
mini-application (applet) to set up the participant's computers 
to dial and redial the Pentagon web site, DefenseLink. The sheer 
volume of requests was intended to shut down the server 
supporting DefenseLink. The EDT posted their intentions on the 
Internet, which allowed the Department of Defense (DoD)_to 
receive warning and counter the protest. According to the 
Pentagon placed on its web site an applet that activated whenever 
FloodNet was detected, which shut down the participant's 
Internet browsers. 


b6 
b7C 


A Pentagon spokeswoman acknowledged the Defense 
Technology Information Center, which supports the DefenseLink Web 
site, launched an effective counter-measure, which they believe 
is defensive in nature and legal. 


The balance of the article contains a discussion 
concerning the Pentagon possibly having crossed the "line" 
between offense and defense, and may have been illegal. Some 
consider the Pentagon's action to be offensive information 
warfare because it attacked back to cause a disruption of service 
or disrupt the system of the participant. 


On 10/7/98 the Department of Justice (DOJ) was contacted 
concerning the actions of DoD, and their opinion was that the DoD 
may have committed a misdemeanor violation by their actions, and 
that DOJ would contact the DoD General Council's Office and 
advise them to discontinue the DoD actions. 


On 10/7/98 a DOJ representative advised that DoD was 
questioning why the FBI did not have the EDT under investigation. : 
DOJ has not furnished any opinion concerning the actions of the 
EDT. 


2 > 
To: New York From: National Security @ 
Re: 288-WF-NEW, 10/15/1998 


The involved Legats were requested to furnish available 
details. The New York office does not have a pending 
investigation on this matter. 


The enclosure contains information that the EDT was 
prepared to release a FloodNet package to a group protesting the 
Federal Communications Commission (FCC). As this protest action 
will apparently continue into the future, with the computer 
systems of the U.S. Government being a probable target, is was 
decided to obtain opinion and guidelines from DOJ (EDVA). It is 
expected that the bulk of protest actions will be received within 
WFO's division. 


As New York has members of the EDT within their division, 
it is requested that New York be kept advised of developments. 


¢** ~ To: New York From: National Security 6 
Re: 288-WF-NEW, 10/15/1998 


LEAD (s): 
Set Lead 1: 


FO 


AT ALEXANDRIA, VIRGINIA 


Determine additional information as necessary and 
present this matter's actions involving both the EDT and the DoD 
to the EDVA and obtain AUSA opinions concerning both 
organizations. Attempt to obtain a guideline as to protest 
actions directed against government computers, and confirm AUSA's 
opinion. If appropriate, furnish both AUSA confirmation and 
closing communication to FBIHQ and New York. 


+4 
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FEDERAL BUREAU OF INVESTIGATION 


Precedence: PRIORITY Date: 11/10/98 


To: FBIHQ Attn: NIPC / CIU / 
SSA 


FBIHO NIPC CIU 
IOS 
i New York 
SA 


From: WFO 


Approved By: 
Drafted By: :maj 


Case ID #: 288-wr-0 -34 


288-HQ-1234199-% Pendimne}+ 
Y 288-NY-268557_)7 Pending} 


Title: UNKNOWN SUBJECT(S), AKA 
ELECTRONIC DISTURBANCE THEATER (EDT) 
DEPARTMENT OF DEFENSE (DOD) 
CITA - Denial of Service 


Synopsis: Lead covered, unless further advised. 
Administrative: FBIHQ EC dated 10/15/98. 


Details: On 11/04/98 AUSA for the Eastern District 
of Virginia (EDVA), and Department of Justice on 
temporary assignment _to the EDVA, were advised of the FBIHQ lead 
dated 10/15/98. Ladvised that the Defense Criminal 
Investigative Service (DCIS) is already investigating this matter 


and Special Agent[~ sd would’ be able to provide 


details. 


On 11/06/98 DCIS Special AgentL sds provided 
WFO with a written explanation of the DEPARTMENT OF DEFENSE’s 
actions which prevented the denial of service attack by the 
ELECTRONIC DISTURBANCE THEATER (EDT). On 11/06/98 WFO provided a 
copy of this information to FBIHOQ, | 
5 
Fl 
In the information DCIS provided, the DEFENSE 
TECHNOLOGY INFORMATION CENTER (DTIC), located. an—Arlington. —V. : 
advised that they were aware in late Auguéé:..chat Defensehayx |was 
the target of a cyberattack sponsored by the EDT.” EDT planned to 
flood DefenseLINK with multiple requests in an, sattempt. fo cause a 


denial of service on 9/9/98. On the day of the attabk’/‘malidious 
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To: FBIHO a. WFO @ 


Re: 288-WF-0, 11/10/98 


traffic to the DTIC servers began with multiple requests to the 
search engine. Many of the initial requests that were meant to 
tie up the DTIC servers came from Austria. 


DTIC, advised that in an attempt bé 
filter out the denial of service attempts and still provide b7C per DTIC 
service to legitimate users, the DTIC wrote a Perl script that 
redirected any malicious traffic away from DefenseLINK to a non- 
existent site. When the EDT protestors continually sent request 
messages to the search engine, the protestors should have 
received an error message pop-up, advising that the DefenseLINK 
website could not be found. If the protestors launched multiple 
attacks, then with every attempt to shut down DefenseLINK, the 
protestors would get another error message back. As a result, 
with all of these error messages coming back, the protestor would 
be forced to reboot the machine. 


Therefore, redirecting the malicious traffic to a non- 
existent site prevented the denial of service to DefenseLINK and 
still permitted access for legitimate users. This rerouting of 
malicious traffic would not have damaged the protestors’ 
computers, but simply caused them to reboot. 


On 11/10/98 the Eastern District of Virginia declined 
prosecution of anyone at DTIC based on the information provided 
above. The Eastern District further declined comment on any 
hypothetical cases involving government protests which may occur 
in the future. 


On 11/10/98 the Eastern District of Virginia further bé 
advised that the venue for the prosecution of EDT should be New b7c 


York. 5 a ot that the New York Field Office 
has an open case (288-NY-268557) on the ELECTRONIC DISTURBANCE 
THEATER and any individuals who take part in these protests. 


UACB, WFO considers this matter RUC. 


o¢ 


